PGMPhys.cpp@ 18811

Last change on this file since 18811 was 18811, checked in by vboxsync, 16 years ago
PGMPhys.cpp,MMHyper.cpp: The MMR3UkHeap bits seems to be working and we're not running out of heap as the guest uses more and more of the memory. Removed the old disabled code.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 113.1 KB

Line
1	/* $Id: PGMPhys.cpp 18811 2009-04-07 12:21:17Z vboxsync $ */
2	/** @file
3	* PGM - Page Manager and Monitor, Physical Memory Addressing.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_PGM_PHYS
27	#include <VBox/pgm.h>
28	#include <VBox/cpum.h>
29	#include <VBox/iom.h>
30	#include <VBox/sup.h>
31	#include <VBox/mm.h>
32	#include <VBox/stam.h>
33	#include <VBox/rem.h>
34	#include <VBox/csam.h>
35	#include "PGMInternal.h"
36	#include <VBox/vm.h>
37	#include <VBox/dbg.h>
38	#include <VBox/param.h>
39	#include <VBox/err.h>
40	#include <iprt/assert.h>
41	#include <iprt/alloc.h>
42	#include <iprt/asm.h>
43	#include <VBox/log.h>
44	#include <iprt/thread.h>
45	#include <iprt/string.h>
46
47
48	/*******************************************************************************
49	* Defined Constants And Macros *
50	*******************************************************************************/
51	/** The number of pages to free in one batch. */
52	#define PGMPHYS_FREE_PAGE_BATCH_SIZE 128
53
54
55	/*******************************************************************************
56	* Internal Functions *
57	*******************************************************************************/
58	static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
59	static int pgmPhysFreePage(PVM pVM, PGMMFREEPAGESREQ pReq, uint32_t *pcPendingPages, PPGMPAGE pPage, RTGCPHYS GCPhys);
60
61
62	/*
63	* PGMR3PhysReadU8-64
64	* PGMR3PhysWriteU8-64
65	*/
66	#define PGMPHYSFN_READNAME PGMR3PhysReadU8
67	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU8
68	#define PGMPHYS_DATASIZE 1
69	#define PGMPHYS_DATATYPE uint8_t
70	#include "PGMPhysRWTmpl.h"
71
72	#define PGMPHYSFN_READNAME PGMR3PhysReadU16
73	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU16
74	#define PGMPHYS_DATASIZE 2
75	#define PGMPHYS_DATATYPE uint16_t
76	#include "PGMPhysRWTmpl.h"
77
78	#define PGMPHYSFN_READNAME PGMR3PhysReadU32
79	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU32
80	#define PGMPHYS_DATASIZE 4
81	#define PGMPHYS_DATATYPE uint32_t
82	#include "PGMPhysRWTmpl.h"
83
84	#define PGMPHYSFN_READNAME PGMR3PhysReadU64
85	#define PGMPHYSFN_WRITENAME PGMR3PhysWriteU64
86	#define PGMPHYS_DATASIZE 8
87	#define PGMPHYS_DATATYPE uint64_t
88	#include "PGMPhysRWTmpl.h"
89
90
91	/**
92	* EMT worker for PGMR3PhysReadExternal.
93	*/
94	static DECLCALLBACK(int) pgmR3PhysReadExternalEMT(PVM pVM, PRTGCPHYS pGCPhys, void *pvBuf, size_t cbRead)
95	{
96	PGMPhysRead(pVM, *pGCPhys, pvBuf, cbRead);
97	return VINF_SUCCESS;
98	}
99
100
101	/**
102	* Write to physical memory, external users.
103	*
104	* @returns VBox status code.
105	* @retval VINF_SUCCESS.
106	*
107	* @param pVM VM Handle.
108	* @param GCPhys Physical address to write to.
109	* @param pvBuf What to write.
110	* @param cbWrite How many bytes to write.
111	*
112	* @thread Any but EMTs.
113	*/
114	VMMR3DECL(int) PGMR3PhysReadExternal(PVM pVM, RTGCPHYS GCPhys, void *pvBuf, size_t cbRead)
115	{
116	VM_ASSERT_OTHER_THREAD(pVM);
117
118	AssertMsgReturn(cbRead > 0, ("don't even think about reading zero bytes!\n"), VINF_SUCCESS);
119	LogFlow(("PGMR3PhysReadExternal: %RGp %d\n", GCPhys, cbRead));
120
121	pgmLock(pVM);
122
123	/*
124	* Copy loop on ram ranges.
125	*/
126	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
127	for (;;)
128	{
129	/* Find range. */
130	while (pRam && GCPhys > pRam->GCPhysLast)
131	pRam = pRam->CTX_SUFF(pNext);
132	/* Inside range or not? */
133	if (pRam && GCPhys >= pRam->GCPhys)
134	{
135	/*
136	* Must work our way thru this page by page.
137	*/
138	RTGCPHYS off = GCPhys - pRam->GCPhys;
139	while (off < pRam->cb)
140	{
141	unsigned iPage = off >> PAGE_SHIFT;
142	PPGMPAGE pPage = &pRam->aPages[iPage];
143
144	/*
145	* If the page has an ALL access handler, we'll have to
146	* delegate the job to EMT.
147	*/
148	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
149	{
150	pgmUnlock(pVM);
151
152	PVMREQ pReq = NULL;
153	int rc = VMR3ReqCall(pVM, VMREQDEST_ANY, &pReq, RT_INDEFINITE_WAIT,
154	(PFNRT)pgmR3PhysReadExternalEMT, 4, pVM, &GCPhys, pvBuf, cbRead);
155	if (RT_SUCCESS(rc))
156	{
157	rc = pReq->iStatus;
158	VMR3ReqFree(pReq);
159	}
160	return rc;
161	}
162	Assert(!PGM_PAGE_IS_MMIO(pPage));
163
164	/*
165	* Simple stuff, go ahead.
166	*/
167	size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
168	if (cb > cbRead)
169	cb = cbRead;
170	const void *pvSrc;
171	int rc = pgmPhysGCPhys2CCPtrInternalReadOnly(pVM, pPage, pRam->GCPhys + off, &pvSrc);
172	if (RT_SUCCESS(rc))
173	memcpy(pvBuf, pvSrc, cb);
174	else
175	{
176	AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternalReadOnly failed on %RGp / %R[pgmpage] -> %Rrc\n",
177	pRam->GCPhys + off, pPage, rc));
178	memset(pvBuf, 0xff, cb);
179	}
180
181	/* next page */
182	if (cb >= cbRead)
183	{
184	pgmUnlock(pVM);
185	return VINF_SUCCESS;
186	}
187	cbRead -= cb;
188	off += cb;
189	GCPhys += cb;
190	pvBuf = (char *)pvBuf + cb;
191	} /* walk pages in ram range. */
192	}
193	else
194	{
195	LogFlow(("PGMPhysRead: Unassigned %RGp size=%u\n", GCPhys, cbRead));
196
197	/*
198	* Unassigned address space.
199	*/
200	if (!pRam)
201	break;
202	size_t cb = pRam->GCPhys - GCPhys;
203	if (cb >= cbRead)
204	{
205	memset(pvBuf, 0xff, cbRead);
206	break;
207	}
208	memset(pvBuf, 0xff, cb);
209
210	cbRead -= cb;
211	pvBuf = (char *)pvBuf + cb;
212	GCPhys += cb;
213	}
214	} /* Ram range walk */
215
216	pgmUnlock(pVM);
217
218	return VINF_SUCCESS;
219	}
220
221
222	/**
223	* EMT worker for PGMR3PhysWriteExternal.
224	*/
225	static DECLCALLBACK(int) pgmR3PhysWriteExternalEMT(PVM pVM, PRTGCPHYS pGCPhys, const void *pvBuf, size_t cbWrite)
226	{
227	/** @todo VERR_EM_NO_MEMORY */
228	PGMPhysWrite(pVM, *pGCPhys, pvBuf, cbWrite);
229	return VINF_SUCCESS;
230	}
231
232
233	/**
234	* Write to physical memory, external users.
235	*
236	* @returns VBox status code.
237	* @retval VINF_SUCCESS.
238	* @retval VERR_EM_NO_MEMORY.
239	*
240	* @param pVM VM Handle.
241	* @param GCPhys Physical address to write to.
242	* @param pvBuf What to write.
243	* @param cbWrite How many bytes to write.
244	*
245	* @thread Any but EMTs.
246	*/
247	VMMDECL(int) PGMR3PhysWriteExternal(PVM pVM, RTGCPHYS GCPhys, const void *pvBuf, size_t cbWrite)
248	{
249	VM_ASSERT_OTHER_THREAD(pVM);
250
251	AssertMsg(!pVM->pgm.s.fNoMorePhysWrites, ("Calling PGMR3PhysWriteExternal after pgmR3Save()!\n"));
252	AssertMsgReturn(cbWrite > 0, ("don't even think about writing zero bytes!\n"), VINF_SUCCESS);
253	LogFlow(("PGMR3PhysWriteExternal: %RGp %d\n", GCPhys, cbWrite));
254
255	pgmLock(pVM);
256
257	/*
258	* Copy loop on ram ranges, stop when we hit something difficult.
259	*/
260	PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(pRamRanges);
261	for (;;)
262	{
263	/* Find range. */
264	while (pRam && GCPhys > pRam->GCPhysLast)
265	pRam = pRam->CTX_SUFF(pNext);
266	/* Inside range or not? */
267	if (pRam && GCPhys >= pRam->GCPhys)
268	{
269	/*
270	* Must work our way thru this page by page.
271	*/
272	RTGCPTR off = GCPhys - pRam->GCPhys;
273	while (off < pRam->cb)
274	{
275	RTGCPTR iPage = off >> PAGE_SHIFT;
276	PPGMPAGE pPage = &pRam->aPages[iPage];
277
278	/*
279	* It the page is in any way problematic, we have to
280	* do the work on the EMT. Anything that needs to be made
281	* writable or involves access handlers is problematic.
282	*/
283	if ( PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
284	\|\| PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
285	{
286	pgmUnlock(pVM);
287
288	PVMREQ pReq = NULL;
289	int rc = VMR3ReqCall(pVM, VMREQDEST_ANY, &pReq, RT_INDEFINITE_WAIT,
290	(PFNRT)pgmR3PhysWriteExternalEMT, 4, pVM, &GCPhys, pvBuf, cbWrite);
291	if (RT_SUCCESS(rc))
292	{
293	rc = pReq->iStatus;
294	VMR3ReqFree(pReq);
295	}
296	return rc;
297	}
298	Assert(!PGM_PAGE_IS_MMIO(pPage));
299
300	/*
301	* Simple stuff, go ahead.
302	*/
303	size_t cb = PAGE_SIZE - (off & PAGE_OFFSET_MASK);
304	if (cb > cbWrite)
305	cb = cbWrite;
306	void *pvDst;
307	int rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, pRam->GCPhys + off, &pvDst);
308	if (RT_SUCCESS(rc))
309	memcpy(pvDst, pvBuf, cb);
310	else
311	AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
312	pRam->GCPhys + off, pPage, rc));
313
314	/* next page */
315	if (cb >= cbWrite)
316	{
317	pgmUnlock(pVM);
318	return VINF_SUCCESS;
319	}
320
321	cbWrite -= cb;
322	off += cb;
323	GCPhys += cb;
324	pvBuf = (const char *)pvBuf + cb;
325	} /* walk pages in ram range */
326	}
327	else
328	{
329	/*
330	* Unassigned address space, skip it.
331	*/
332	if (!pRam)
333	break;
334	size_t cb = pRam->GCPhys - GCPhys;
335	if (cb >= cbWrite)
336	break;
337	cbWrite -= cb;
338	pvBuf = (const char *)pvBuf + cb;
339	GCPhys += cb;
340	}
341	} /* Ram range walk */
342
343	pgmUnlock(pVM);
344	return VINF_SUCCESS;
345	}
346
347
348	/**
349	* VMR3ReqCall worker for PGMR3PhysGCPhys2CCPtrExternal to make pages writable.
350	*
351	* @returns see PGMR3PhysGCPhys2CCPtrExternal
352	* @param pVM The VM handle.
353	* @param pGCPhys Pointer to the guest physical address.
354	* @param ppv Where to store the mapping address.
355	* @param pLock Where to store the lock.
356	*/
357	static DECLCALLBACK(int) pgmR3PhysGCPhys2CCPtrDelegated(PVM pVM, PRTGCPHYS pGCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
358	{
359	/*
360	* Just hand it to PGMPhysGCPhys2CCPtr and check that it's not a page with
361	* an access handler after it succeeds.
362	*/
363	int rc = pgmLock(pVM);
364	AssertRCReturn(rc, rc);
365
366	rc = PGMPhysGCPhys2CCPtr(pVM, *pGCPhys, ppv, pLock);
367	if (RT_SUCCESS(rc))
368	{
369	PPGMPAGEMAPTLBE pTlbe;
370	int rc2 = pgmPhysPageQueryTlbe(&pVM->pgm.s, *pGCPhys, &pTlbe);
371	AssertFatalRC(rc2);
372	PPGMPAGE pPage = pTlbe->pPage;
373	#if 1
374	if (PGM_PAGE_IS_MMIO(pPage))
375	#else
376	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
377	#endif
378	{
379	PGMPhysReleasePageMappingLock(pVM, pLock);
380	rc = VERR_PGM_PHYS_PAGE_RESERVED;
381	}
382	}
383
384	pgmUnlock(pVM);
385	return rc;
386	}
387
388
389	/**
390	* Requests the mapping of a guest page into ring-3, external threads.
391	*
392	* When you're done with the page, call PGMPhysReleasePageMappingLock() ASAP to
393	* release it.
394	*
395	* This API will assume your intention is to write to the page, and will
396	* therefore replace shared and zero pages. If you do not intend to modify the
397	* page, use the PGMR3PhysGCPhys2CCPtrReadOnlyExternal() API.
398	*
399	* @returns VBox status code.
400	* @retval VINF_SUCCESS on success.
401	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical
402	* backing or if the page has any active access handlers. The caller
403	* must fall back on using PGMR3PhysWriteExternal.
404	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
405	*
406	* @param pVM The VM handle.
407	* @param GCPhys The guest physical address of the page that should be mapped.
408	* @param ppv Where to store the address corresponding to GCPhys.
409	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
410	*
411	* @remark Avoid calling this API from within critical sections (other than the
412	* PGM one) because of the deadlock risk when we have to delegating the
413	* task to an EMT.
414	* @thread Any.
415	*/
416	VMMR3DECL(int) PGMR3PhysGCPhys2CCPtrExternal(PVM pVM, RTGCPHYS GCPhys, void **ppv, PPGMPAGEMAPLOCK pLock)
417	{
418	AssertPtr(ppv);
419	AssertPtr(pLock);
420
421	int rc = pgmLock(pVM);
422	AssertRCReturn(rc, rc);
423
424	/*
425	* Query the Physical TLB entry for the page (may fail).
426	*/
427	PPGMPAGEMAPTLBE pTlbe;
428	rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
429	if (RT_SUCCESS(rc))
430	{
431	PPGMPAGE pPage = pTlbe->pPage;
432	#if 1
433	if (PGM_PAGE_IS_MMIO(pPage))
434	rc = VERR_PGM_PHYS_PAGE_RESERVED;
435	#else
436	if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
437	rc = VERR_PGM_PHYS_PAGE_RESERVED;
438	#endif
439	else
440	{
441	/*
442	* If the page is shared, the zero page, or being write monitored
443	* it must be converted to an page that's writable if possible.
444	* This has to be done on an EMT.
445	*/
446	if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED))
447	{
448	pgmUnlock(pVM);
449
450	PVMREQ pReq = NULL;
451	rc = VMR3ReqCall(pVM, VMREQDEST_ANY, &pReq, RT_INDEFINITE_WAIT,
452	(PFNRT)pgmR3PhysGCPhys2CCPtrDelegated, 4, pVM, &GCPhys, ppv, pLock);
453	if (RT_SUCCESS(rc))
454	{
455	rc = pReq->iStatus;
456	VMR3ReqFree(pReq);
457	}
458	return rc;
459	}
460
461	/*
462	* Now, just perform the locking and calculate the return address.
463	*/
464	PPGMPAGEMAP pMap = pTlbe->pMap;
465	pMap->cRefs++;
466	#if 0 /** @todo implement locking properly */
467	if (RT_LIKELY(pPage->cLocks != PGM_PAGE_MAX_LOCKS))
468	if (RT_UNLIKELY(++pPage->cLocks == PGM_PAGE_MAX_LOCKS))
469	{
470	AssertMsgFailed(("%RGp is entering permanent locked state!\n", GCPhys));
471	pMap->cRefs++; /* Extra ref to prevent it from going away. */
472	}
473	#endif
474	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
475	pLock->pvPage = pPage;
476	pLock->pvMap = pMap;
477	}
478	}
479
480	pgmUnlock(pVM);
481	return rc;
482	}
483
484
485	/**
486	* Requests the mapping of a guest page into ring-3, external threads.
487	*
488	* When you're done with the page, call PGMPhysReleasePageMappingLock() ASAP to
489	* release it.
490	*
491	* @returns VBox status code.
492	* @retval VINF_SUCCESS on success.
493	* @retval VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical
494	* backing or if the page as an active ALL access handler. The caller
495	* must fall back on using PGMPhysRead.
496	* @retval VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
497	*
498	* @param pVM The VM handle.
499	* @param GCPhys The guest physical address of the page that should be mapped.
500	* @param ppv Where to store the address corresponding to GCPhys.
501	* @param pLock Where to store the lock information that PGMPhysReleasePageMappingLock needs.
502	*
503	* @remark Avoid calling this API from within critical sections (other than
504	* the PGM one) because of the deadlock risk.
505	* @thread Any.
506	*/
507	VMMR3DECL(int) PGMR3PhysGCPhys2CCPtrReadOnlyExternal(PVM pVM, RTGCPHYS GCPhys, void const **ppv, PPGMPAGEMAPLOCK pLock)
508	{
509	int rc = pgmLock(pVM);
510	AssertRCReturn(rc, rc);
511
512	/*
513	* Query the Physical TLB entry for the page (may fail).
514	*/
515	PPGMPAGEMAPTLBE pTlbe;
516	rc = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
517	if (RT_SUCCESS(rc))
518	{
519	PPGMPAGE pPage = pTlbe->pPage;
520	#if 1
521	/* MMIO pages doesn't have any readable backing. */
522	if (PGM_PAGE_IS_MMIO(pPage))
523	rc = VERR_PGM_PHYS_PAGE_RESERVED;
524	#else
525	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage))
526	rc = VERR_PGM_PHYS_PAGE_RESERVED;
527	#endif
528	else
529	{
530	/*
531	* Now, just perform the locking and calculate the return address.
532	*/
533	PPGMPAGEMAP pMap = pTlbe->pMap;
534	pMap->cRefs++;
535	#if 0 /** @todo implement locking properly */
536	if (RT_LIKELY(pPage->cLocks != PGM_PAGE_MAX_LOCKS))
537	if (RT_UNLIKELY(++pPage->cLocks == PGM_PAGE_MAX_LOCKS))
538	{
539	AssertMsgFailed(("%RGp is entering permanent locked state!\n", GCPhys));
540	pMap->cRefs++; /* Extra ref to prevent it from going away. */
541	}
542	#endif
543	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
544	pLock->pvPage = pPage;
545	pLock->pvMap = pMap;
546	}
547	}
548
549	pgmUnlock(pVM);
550	return rc;
551	}
552
553
554	/**
555	* Relinks the RAM ranges using the pSelfRC and pSelfR0 pointers.
556	*
557	* Called when anything was relocated.
558	*
559	* @param pVM Pointer to the shared VM structure.
560	*/
561	void pgmR3PhysRelinkRamRanges(PVM pVM)
562	{
563	PPGMRAMRANGE pCur;
564
565	#ifdef VBOX_STRICT
566	for (pCur = pVM->pgm.s.pRamRangesR3; pCur; pCur = pCur->pNextR3)
567	{
568	Assert((pCur->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pCur->pSelfR0 == MMHyperCCToR0(pVM, pCur));
569	Assert((pCur->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pCur->pSelfRC == MMHyperCCToRC(pVM, pCur));
570	Assert((pCur->GCPhys & PAGE_OFFSET_MASK) == 0);
571	Assert((pCur->GCPhysLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
572	Assert((pCur->cb & PAGE_OFFSET_MASK) == 0);
573	Assert(pCur->cb == pCur->GCPhysLast - pCur->GCPhys + 1);
574	for (PPGMRAMRANGE pCur2 = pVM->pgm.s.pRamRangesR3; pCur2; pCur2 = pCur2->pNextR3)
575	Assert( pCur2 == pCur
576	\|\| strcmp(pCur2->pszDesc, pCur->pszDesc)); /** @todo fix MMIO ranges!! */
577	}
578	#endif
579
580	pCur = pVM->pgm.s.pRamRangesR3;
581	if (pCur)
582	{
583	pVM->pgm.s.pRamRangesR0 = pCur->pSelfR0;
584	pVM->pgm.s.pRamRangesRC = pCur->pSelfRC;
585
586	for (; pCur->pNextR3; pCur = pCur->pNextR3)
587	{
588	pCur->pNextR0 = pCur->pNextR3->pSelfR0;
589	pCur->pNextRC = pCur->pNextR3->pSelfRC;
590	}
591
592	Assert(pCur->pNextR0 == NIL_RTR0PTR);
593	Assert(pCur->pNextRC == NIL_RTRCPTR);
594	}
595	else
596	{
597	Assert(pVM->pgm.s.pRamRangesR0 == NIL_RTR0PTR);
598	Assert(pVM->pgm.s.pRamRangesRC == NIL_RTRCPTR);
599	}
600	}
601
602
603	/**
604	* Links a new RAM range into the list.
605	*
606	* @param pVM Pointer to the shared VM structure.
607	* @param pNew Pointer to the new list entry.
608	* @param pPrev Pointer to the previous list entry. If NULL, insert as head.
609	*/
610	static void pgmR3PhysLinkRamRange(PVM pVM, PPGMRAMRANGE pNew, PPGMRAMRANGE pPrev)
611	{
612	AssertMsg(pNew->pszDesc, ("%RGp-%RGp\n", pNew->GCPhys, pNew->GCPhysLast));
613	Assert((pNew->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pNew->pSelfR0 == MMHyperCCToR0(pVM, pNew));
614	Assert((pNew->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pNew->pSelfRC == MMHyperCCToRC(pVM, pNew));
615
616	pgmLock(pVM);
617
618	PPGMRAMRANGE pRam = pPrev ? pPrev->pNextR3 : pVM->pgm.s.pRamRangesR3;
619	pNew->pNextR3 = pRam;
620	pNew->pNextR0 = pRam ? pRam->pSelfR0 : NIL_RTR0PTR;
621	pNew->pNextRC = pRam ? pRam->pSelfRC : NIL_RTRCPTR;
622
623	if (pPrev)
624	{
625	pPrev->pNextR3 = pNew;
626	pPrev->pNextR0 = pNew->pSelfR0;
627	pPrev->pNextRC = pNew->pSelfRC;
628	}
629	else
630	{
631	pVM->pgm.s.pRamRangesR3 = pNew;
632	pVM->pgm.s.pRamRangesR0 = pNew->pSelfR0;
633	pVM->pgm.s.pRamRangesRC = pNew->pSelfRC;
634	}
635
636	pgmUnlock(pVM);
637	}
638
639
640	/**
641	* Unlink an existing RAM range from the list.
642	*
643	* @param pVM Pointer to the shared VM structure.
644	* @param pRam Pointer to the new list entry.
645	* @param pPrev Pointer to the previous list entry. If NULL, insert as head.
646	*/
647	static void pgmR3PhysUnlinkRamRange2(PVM pVM, PPGMRAMRANGE pRam, PPGMRAMRANGE pPrev)
648	{
649	Assert(pPrev ? pPrev->pNextR3 == pRam : pVM->pgm.s.pRamRangesR3 == pRam);
650	Assert((pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pRam->pSelfR0 == MMHyperCCToR0(pVM, pRam));
651	Assert((pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING) \|\| pRam->pSelfRC == MMHyperCCToRC(pVM, pRam));
652
653	pgmLock(pVM);
654
655	PPGMRAMRANGE pNext = pRam->pNextR3;
656	if (pPrev)
657	{
658	pPrev->pNextR3 = pNext;
659	pPrev->pNextR0 = pNext ? pNext->pSelfR0 : NIL_RTR0PTR;
660	pPrev->pNextRC = pNext ? pNext->pSelfRC : NIL_RTRCPTR;
661	}
662	else
663	{
664	Assert(pVM->pgm.s.pRamRangesR3 == pRam);
665	pVM->pgm.s.pRamRangesR3 = pNext;
666	pVM->pgm.s.pRamRangesR0 = pNext ? pNext->pSelfR0 : NIL_RTR0PTR;
667	pVM->pgm.s.pRamRangesRC = pNext ? pNext->pSelfRC : NIL_RTRCPTR;
668	}
669
670	pgmUnlock(pVM);
671	}
672
673
674	/**
675	* Unlink an existing RAM range from the list.
676	*
677	* @param pVM Pointer to the shared VM structure.
678	* @param pRam Pointer to the new list entry.
679	*/
680	static void pgmR3PhysUnlinkRamRange(PVM pVM, PPGMRAMRANGE pRam)
681	{
682	pgmLock(pVM);
683
684	/* find prev. */
685	PPGMRAMRANGE pPrev = NULL;
686	PPGMRAMRANGE pCur = pVM->pgm.s.pRamRangesR3;
687	while (pCur != pRam)
688	{
689	pPrev = pCur;
690	pCur = pCur->pNextR3;
691	}
692	AssertFatal(pCur);
693
694	pgmR3PhysUnlinkRamRange2(pVM, pRam, pPrev);
695
696	pgmUnlock(pVM);
697	}
698
699
700	/**
701	* Frees a range of pages, replacing them with ZERO pages of the specified type.
702	*
703	* @returns VBox status code.
704	* @param pVM The VM handle.
705	* @param pRam The RAM range in which the pages resides.
706	* @param GCPhys The address of the first page.
707	* @param GCPhysLast The address of the last page.
708	* @param uType The page type to replace then with.
709	*/
710	static int pgmR3PhysFreePageRange(PVM pVM, PPGMRAMRANGE pRam, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast, uint8_t uType)
711	{
712	uint32_t cPendingPages = 0;
713	PGMMFREEPAGESREQ pReq;
714	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
715	AssertLogRelRCReturn(rc, rc);
716
717	/* Itegerate the pages. */
718	PPGMPAGE pPageDst = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
719	uint32_t cPagesLeft = ((GCPhysLast - GCPhys) >> PAGE_SHIFT) + 1;
720	while (cPagesLeft-- > 0)
721	{
722	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPageDst, GCPhys);
723	AssertLogRelRCReturn(rc, rc); /* We're done for if this goes wrong. */
724
725	PGM_PAGE_SET_TYPE(pPageDst, uType);
726
727	GCPhys += PAGE_SIZE;
728	pPageDst++;
729	}
730
731	if (cPendingPages)
732	{
733	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
734	AssertLogRelRCReturn(rc, rc);
735	}
736	GMMR3FreePagesCleanup(pReq);
737
738	return rc;
739	}
740
741
742	/**
743	* PGMR3PhysRegisterRam worker that initializes and links a RAM range.
744	*
745	* @param pVM The VM handle.
746	* @param pNew The new RAM range.
747	* @param GCPhys The address of the RAM range.
748	* @param GCPhysLast The last address of the RAM range.
749	* @param RCPtrNew The RC address if the range is floating. NIL_RTRCPTR
750	* if in HMA.
751	* @param R0PtrNew Ditto for R0.
752	* @param pszDesc The description.
753	* @param pPrev The previous RAM range (for linking).
754	*/
755	static void pgmR3PhysInitAndLinkRamRange(PVM pVM, PPGMRAMRANGE pNew, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast,
756	RTRCPTR RCPtrNew, RTR0PTR R0PtrNew, const char *pszDesc, PPGMRAMRANGE pPrev)
757	{
758	/*
759	* Initialize the range.
760	*/
761	pNew->pSelfR0 = R0PtrNew != NIL_RTR0PTR ? R0PtrNew : MMHyperCCToR0(pVM, pNew);
762	pNew->pSelfRC = RCPtrNew != NIL_RTRCPTR ? RCPtrNew : MMHyperCCToRC(pVM, pNew);
763	pNew->GCPhys = GCPhys;
764	pNew->GCPhysLast = GCPhysLast;
765	pNew->cb = GCPhysLast - GCPhys + 1;
766	pNew->pszDesc = pszDesc;
767	pNew->fFlags = RCPtrNew != NIL_RTR0PTR ? PGM_RAM_RANGE_FLAGS_FLOATING : 0;
768	pNew->pvR3 = NULL;
769
770	uint32_t const cPages = pNew->cb >> PAGE_SHIFT;
771	RTGCPHYS iPage = cPages;
772	while (iPage-- > 0)
773	PGM_PAGE_INIT_ZERO(&pNew->aPages[iPage], pVM, PGMPAGETYPE_RAM);
774
775	/* Update the page count stats. */
776	pVM->pgm.s.cZeroPages += cPages;
777	pVM->pgm.s.cAllPages += cPages;
778
779	/*
780	* Link it.
781	*/
782	pgmR3PhysLinkRamRange(pVM, pNew, pPrev);
783	}
784
785
786	/**
787	* Relocate a floating RAM range.
788	*
789	* @copydoc FNPGMRELOCATE.
790	*/
791	static DECLCALLBACK(bool) pgmR3PhysRamRangeRelocate(PVM pVM, RTGCPTR GCPtrOld, RTGCPTR GCPtrNew, PGMRELOCATECALL enmMode, void *pvUser)
792	{
793	PPGMRAMRANGE pRam = (PPGMRAMRANGE)pvUser;
794	Assert(pRam->fFlags & PGM_RAM_RANGE_FLAGS_FLOATING);
795	Assert(pRam->pSelfRC == GCPtrOld + PAGE_SIZE);
796
797	switch (enmMode)
798	{
799	case PGMRELOCATECALL_SUGGEST:
800	return true;
801	case PGMRELOCATECALL_RELOCATE:
802	{
803	/* Update myself and then relink all the ranges. */
804	pgmLock(pVM);
805	pRam->pSelfRC = (RTRCPTR)(GCPtrNew + PAGE_SIZE);
806	pgmR3PhysRelinkRamRanges(pVM);
807	pgmUnlock(pVM);
808	return true;
809	}
810
811	default:
812	AssertFailedReturn(false);
813	}
814	}
815
816
817	/**
818	* PGMR3PhysRegisterRam worker that registers a high chunk.
819	*
820	* @returns VBox status code.
821	* @param pVM The VM handle.
822	* @param GCPhys The address of the RAM.
823	* @param cRamPages The number of RAM pages to register.
824	* @param cbChunk The size of the PGMRAMRANGE guest mapping.
825	* @param iChunk The chunk number.
826	* @param pszDesc The RAM range description.
827	* @param ppPrev Previous RAM range pointer. In/Out.
828	*/
829	static int pgmR3PhysRegisterHighRamChunk(PVM pVM, RTGCPHYS GCPhys, uint32_t cRamPages,
830	uint32_t cbChunk, uint32_t iChunk, const char *pszDesc,
831	PPGMRAMRANGE *ppPrev)
832	{
833	const char *pszDescChunk = iChunk == 0
834	? pszDesc
835	: MMR3HeapAPrintf(pVM, MM_TAG_PGM_PHYS, "%s (#%u)", pszDesc, iChunk + 1);
836	AssertReturn(pszDescChunk, VERR_NO_MEMORY);
837
838	/*
839	* Allocate memory for the new chunk.
840	*/
841	size_t const cChunkPages = RT_ALIGN_Z(RT_UOFFSETOF(PGMRAMRANGE, aPages[cRamPages]), PAGE_SIZE) >> PAGE_SHIFT;
842	PSUPPAGE paChunkPages = (PSUPPAGE)RTMemTmpAllocZ(sizeof(SUPPAGE) * cChunkPages);
843	AssertReturn(paChunkPages, VERR_NO_TMP_MEMORY);
844	RTR0PTR R0PtrChunk = NIL_RTR0PTR;
845	void *pvChunk = NULL;
846	int rc = SUPR3PageAllocEx(cChunkPages, 0 /fFlags/, &pvChunk,
847	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
848	VMMIsHwVirtExtForced(pVM) ? &R0PtrChunk : NULL,
849	#else
850	NULL,
851	#endif
852	paChunkPages);
853	if (RT_SUCCESS(rc))
854	{
855	#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
856	if (!VMMIsHwVirtExtForced(pVM))
857	R0PtrChunk = NIL_RTR0PTR;
858	#else
859	R0PtrChunk = (uintptr_t)pvChunk;
860	#endif
861	memset(pvChunk, 0, cChunkPages << PAGE_SHIFT);
862
863	PPGMRAMRANGE pNew = (PPGMRAMRANGE)pvChunk;
864
865	/*
866	* Create a mapping and map the pages into it.
867	* We push these in below the HMA.
868	*/
869	RTGCPTR GCPtrChunkMap = pVM->pgm.s.GCPtrPrevRamRangeMapping - cbChunk;
870	rc = PGMR3MapPT(pVM, GCPtrChunkMap, cbChunk, 0 /fFlags/, pgmR3PhysRamRangeRelocate, pNew, pszDescChunk);
871	if (RT_SUCCESS(rc))
872	{
873	pVM->pgm.s.GCPtrPrevRamRangeMapping = GCPtrChunkMap;
874
875	RTGCPTR const GCPtrChunk = GCPtrChunkMap + PAGE_SIZE;
876	RTGCPTR GCPtrPage = GCPtrChunk;
877	for (uint32_t iPage = 0; iPage < cChunkPages && RT_SUCCESS(rc); iPage++, GCPtrPage += PAGE_SIZE)
878	rc = PGMMap(pVM, GCPtrPage, paChunkPages[iPage].Phys, PAGE_SIZE, 0);
879	if (RT_SUCCESS(rc))
880	{
881	/*
882	* Ok, init and link the range.
883	*/
884	pgmR3PhysInitAndLinkRamRange(pVM, pNew, GCPhys, GCPhys + ((RTGCPHYS)cRamPages << PAGE_SHIFT) - 1,
885	(RTRCPTR)GCPtrChunk, R0PtrChunk, pszDescChunk, *ppPrev);
886	*ppPrev = pNew;
887	}
888	}
889
890	if (RT_FAILURE(rc))
891	SUPR3PageFreeEx(pvChunk, cChunkPages);
892	}
893
894	RTMemTmpFree(paChunkPages);
895	return rc;
896	}
897
898
899	/**
900	* Sets up a range RAM.
901	*
902	* This will check for conflicting registrations, make a resource
903	* reservation for the memory (with GMM), and setup the per-page
904	* tracking structures (PGMPAGE).
905	*
906	* @returns VBox stutus code.
907	* @param pVM Pointer to the shared VM structure.
908	* @param GCPhys The physical address of the RAM.
909	* @param cb The size of the RAM.
910	* @param pszDesc The description - not copied, so, don't free or change it.
911	*/
912	VMMR3DECL(int) PGMR3PhysRegisterRam(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, const char *pszDesc)
913	{
914	/*
915	* Validate input.
916	*/
917	Log(("PGMR3PhysRegisterRam: GCPhys=%RGp cb=%RGp pszDesc=%s\n", GCPhys, cb, pszDesc));
918	AssertReturn(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys, VERR_INVALID_PARAMETER);
919	AssertReturn(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb, VERR_INVALID_PARAMETER);
920	AssertReturn(cb > 0, VERR_INVALID_PARAMETER);
921	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
922	AssertMsgReturn(GCPhysLast > GCPhys, ("The range wraps! GCPhys=%RGp cb=%RGp\n", GCPhys, cb), VERR_INVALID_PARAMETER);
923	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
924	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
925
926	/*
927	* Find range location and check for conflicts.
928	* (We don't lock here because the locking by EMT is only required on update.)
929	*/
930	PPGMRAMRANGE pPrev = NULL;
931	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
932	while (pRam && GCPhysLast >= pRam->GCPhys)
933	{
934	if ( GCPhysLast >= pRam->GCPhys
935	&& GCPhys <= pRam->GCPhysLast)
936	AssertLogRelMsgFailedReturn(("%RGp-%RGp (%s) conflicts with existing %RGp-%RGp (%s)\n",
937	GCPhys, GCPhysLast, pszDesc,
938	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
939	VERR_PGM_RAM_CONFLICT);
940
941	/* next */
942	pPrev = pRam;
943	pRam = pRam->pNextR3;
944	}
945
946	/*
947	* Register it with GMM (the API bitches).
948	*/
949	const RTGCPHYS cPages = cb >> PAGE_SHIFT;
950	int rc = MMR3IncreaseBaseReservation(pVM, cPages);
951	if (RT_FAILURE(rc))
952	return rc;
953
954	if ( GCPhys >= _4G
955	&& cPages > 256)
956	{
957	/*
958	* The PGMRAMRANGE structures for the high memory can get very big.
959	* In order to avoid SUPR3PageAllocEx allocation failures due to the
960	* allocation size limit there and also to avoid being unable to find
961	* guest mapping space for them, we split this memory up into 4MB in
962	* (potential) raw-mode configs and 16MB chunks in forced AMD-V/VT-x
963	* mode.
964	*
965	* The first and last page of each mapping are guard pages and marked
966	* not-present. So, we've got 4186112 and 16769024 bytes available for
967	* the PGMRAMRANGE structure.
968	*
969	* Note! The sizes used here will influence the saved state.
970	*/
971	uint32_t cbChunk;
972	uint32_t cPagesPerChunk;
973	if (VMMIsHwVirtExtForced(pVM))
974	{
975	cbChunk = 16U*_1M;
976	cPagesPerChunk = 1048048; /* max ~1048059 */
977	AssertCompile(sizeof(PGMRAMRANGE) + sizeof(PGMPAGE) * 1048048 < 16U_1M - PAGE_SIZE 2);
978	}
979	else
980	{
981	cbChunk = 4U*_1M;
982	cPagesPerChunk = 261616; /* max ~261627 */
983	AssertCompile(sizeof(PGMRAMRANGE) + sizeof(PGMPAGE) * 261616 < 4U_1M - PAGE_SIZE 2);
984	}
985	AssertRelease(RT_UOFFSETOF(PGMRAMRANGE, aPages[cPagesPerChunk]) + PAGE_SIZE * 2 <= cbChunk);
986
987	RTGCPHYS cPagesLeft = cPages;
988	RTGCPHYS GCPhysChunk = GCPhys;
989	uint32_t iChunk = 0;
990	while (cPagesLeft > 0)
991	{
992	uint32_t cPagesInChunk = cPagesLeft;
993	if (cPagesInChunk > cPagesPerChunk)
994	cPagesInChunk = cPagesPerChunk;
995
996	rc = pgmR3PhysRegisterHighRamChunk(pVM, GCPhysChunk, cPagesInChunk, cbChunk, iChunk, pszDesc, &pPrev);
997	AssertRCReturn(rc, rc);
998
999	/* advance */
1000	GCPhysChunk += (RTGCPHYS)cPagesInChunk << PAGE_SHIFT;
1001	cPagesLeft -= cPagesInChunk;
1002	iChunk++;
1003	}
1004	}
1005	else
1006	{
1007	/*
1008	* Allocate, initialize and link the new RAM range.
1009	*/
1010	const size_t cbRamRange = RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]);
1011	PPGMRAMRANGE pNew;
1012	rc = MMR3HyperAllocOnceNoRel(pVM, cbRamRange, 0, MM_TAG_PGM_PHYS, (void **)&pNew);
1013	AssertLogRelMsgRCReturn(rc, ("cbRamRange=%zu\n", cbRamRange), rc);
1014
1015	pgmR3PhysInitAndLinkRamRange(pVM, pNew, GCPhys, GCPhysLast, NIL_RTRCPTR, NIL_RTR0PTR, pszDesc, pPrev);
1016	}
1017
1018	/*
1019	* Notify REM.
1020	*/
1021	REMR3NotifyPhysRamRegister(pVM, GCPhys, cb, REM_NOTIFY_PHYS_RAM_FLAGS_RAM);
1022
1023	return VINF_SUCCESS;
1024	}
1025
1026
1027	/**
1028	* Resets (zeros) the RAM.
1029	*
1030	* ASSUMES that the caller owns the PGM lock.
1031	*
1032	* @returns VBox status code.
1033	* @param pVM Pointer to the shared VM structure.
1034	*/
1035	int pgmR3PhysRamReset(PVM pVM)
1036	{
1037	/*
1038	* We batch up pages before freeing them.
1039	*/
1040	uint32_t cPendingPages = 0;
1041	PGMMFREEPAGESREQ pReq;
1042	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
1043	AssertLogRelRCReturn(rc, rc);
1044
1045	/*
1046	* Walk the ram ranges.
1047	*/
1048	for (PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3; pRam; pRam = pRam->pNextR3)
1049	{
1050	uint32_t iPage = pRam->cb >> PAGE_SHIFT;
1051	AssertMsg(((RTGCPHYS)iPage << PAGE_SHIFT) == pRam->cb, ("%RGp %RGp\n", (RTGCPHYS)iPage << PAGE_SHIFT, pRam->cb));
1052
1053	if (!pVM->pgm.s.fRamPreAlloc)
1054	{
1055	/* Replace all RAM pages by ZERO pages. */
1056	while (iPage-- > 0)
1057	{
1058	PPGMPAGE pPage = &pRam->aPages[iPage];
1059	switch (PGM_PAGE_GET_TYPE(pPage))
1060	{
1061	case PGMPAGETYPE_RAM:
1062	if (!PGM_PAGE_IS_ZERO(pPage))
1063	{
1064	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1065	AssertLogRelRCReturn(rc, rc);
1066	}
1067	break;
1068
1069	case PGMPAGETYPE_MMIO2_ALIAS_MMIO:
1070	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1071	break;
1072
1073	case PGMPAGETYPE_MMIO2:
1074	case PGMPAGETYPE_ROM_SHADOW: /* handled by pgmR3PhysRomReset. */
1075	case PGMPAGETYPE_ROM:
1076	case PGMPAGETYPE_MMIO:
1077	break;
1078	default:
1079	AssertFailed();
1080	}
1081	} /* for each page */
1082	}
1083	else
1084	{
1085	/* Zero the memory. */
1086	while (iPage-- > 0)
1087	{
1088	PPGMPAGE pPage = &pRam->aPages[iPage];
1089	switch (PGM_PAGE_GET_TYPE(pPage))
1090	{
1091	case PGMPAGETYPE_RAM:
1092	switch (PGM_PAGE_GET_STATE(pPage))
1093	{
1094	case PGM_PAGE_STATE_ZERO:
1095	break;
1096	case PGM_PAGE_STATE_SHARED:
1097	case PGM_PAGE_STATE_WRITE_MONITORED:
1098	rc = pgmPhysPageMakeWritable(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1099	AssertLogRelRCReturn(rc, rc);
1100	case PGM_PAGE_STATE_ALLOCATED:
1101	{
1102	void *pvPage;
1103	PPGMPAGEMAP pMapIgnored;
1104	rc = pgmPhysPageMap(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pMapIgnored, &pvPage);
1105	AssertLogRelRCReturn(rc, rc);
1106	ASMMemZeroPage(pvPage);
1107	break;
1108	}
1109	}
1110	break;
1111
1112	case PGMPAGETYPE_MMIO2_ALIAS_MMIO:
1113	pgmHandlerPhysicalResetAliasedPage(pVM, pPage, pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT));
1114	break;
1115
1116	case PGMPAGETYPE_MMIO2:
1117	case PGMPAGETYPE_ROM_SHADOW:
1118	case PGMPAGETYPE_ROM:
1119	case PGMPAGETYPE_MMIO:
1120	break;
1121	default:
1122	AssertFailed();
1123
1124	}
1125	} /* for each page */
1126	}
1127
1128	}
1129
1130	/*
1131	* Finish off any pages pending freeing.
1132	*/
1133	if (cPendingPages)
1134	{
1135	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
1136	AssertLogRelRCReturn(rc, rc);
1137	}
1138	GMMR3FreePagesCleanup(pReq);
1139
1140	return VINF_SUCCESS;
1141	}
1142
1143
1144	/**
1145	* This is the interface IOM is using to register an MMIO region.
1146	*
1147	* It will check for conflicts and ensure that a RAM range structure
1148	* is present before calling the PGMR3HandlerPhysicalRegister API to
1149	* register the callbacks.
1150	*
1151	* @returns VBox status code.
1152	*
1153	* @param pVM Pointer to the shared VM structure.
1154	* @param GCPhys The start of the MMIO region.
1155	* @param cb The size of the MMIO region.
1156	* @param pfnHandlerR3 The address of the ring-3 handler. (IOMR3MMIOHandler)
1157	* @param pvUserR3 The user argument for R3.
1158	* @param pfnHandlerR0 The address of the ring-0 handler. (IOMMMIOHandler)
1159	* @param pvUserR0 The user argument for R0.
1160	* @param pfnHandlerRC The address of the RC handler. (IOMMMIOHandler)
1161	* @param pvUserRC The user argument for RC.
1162	* @param pszDesc The description of the MMIO region.
1163	*/
1164	VMMR3DECL(int) PGMR3PhysMMIORegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb,
1165	R3PTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTR3PTR pvUserR3,
1166	R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTR0PTR pvUserR0,
1167	RCPTRTYPE(PFNPGMRCPHYSHANDLER) pfnHandlerRC, RTRCPTR pvUserRC,
1168	R3PTRTYPE(const char *) pszDesc)
1169	{
1170	/*
1171	* Assert on some assumption.
1172	*/
1173	VM_ASSERT_EMT(pVM);
1174	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1175	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1176	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
1177	AssertReturn(*pszDesc, VERR_INVALID_PARAMETER);
1178
1179	/*
1180	* Make sure there's a RAM range structure for the region.
1181	*/
1182	int rc;
1183	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
1184	bool fRamExists = false;
1185	PPGMRAMRANGE pRamPrev = NULL;
1186	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1187	while (pRam && GCPhysLast >= pRam->GCPhys)
1188	{
1189	if ( GCPhysLast >= pRam->GCPhys
1190	&& GCPhys <= pRam->GCPhysLast)
1191	{
1192	/* Simplification: all within the same range. */
1193	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
1194	&& GCPhysLast <= pRam->GCPhysLast,
1195	("%RGp-%RGp (MMIO/%s) falls partly outside %RGp-%RGp (%s)\n",
1196	GCPhys, GCPhysLast, pszDesc,
1197	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
1198	VERR_PGM_RAM_CONFLICT);
1199
1200	/* Check that it's all RAM or MMIO pages. */
1201	PCPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1202	uint32_t cLeft = cb >> PAGE_SHIFT;
1203	while (cLeft-- > 0)
1204	{
1205	AssertLogRelMsgReturn( PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM
1206	\|\| PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO,
1207	("%RGp-%RGp (MMIO/%s): %RGp is not a RAM or MMIO page - type=%d desc=%s\n",
1208	GCPhys, GCPhysLast, pszDesc, PGM_PAGE_GET_TYPE(pPage), pRam->pszDesc),
1209	VERR_PGM_RAM_CONFLICT);
1210	pPage++;
1211	}
1212
1213	/* Looks good. */
1214	fRamExists = true;
1215	break;
1216	}
1217
1218	/* next */
1219	pRamPrev = pRam;
1220	pRam = pRam->pNextR3;
1221	}
1222	PPGMRAMRANGE pNew;
1223	if (fRamExists)
1224	{
1225	pNew = NULL;
1226
1227	/*
1228	* Make all the pages in the range MMIO/ZERO pages, freeing any
1229	* RAM pages currently mapped here. This might not be 100% correct
1230	* for PCI memory, but we're doing the same thing for MMIO2 pages.
1231	*/
1232	rc = pgmLock(pVM);
1233	if (RT_SUCCESS(rc))
1234	{
1235	rc = pgmR3PhysFreePageRange(pVM, pRam, GCPhys, GCPhysLast, PGMPAGETYPE_MMIO);
1236	pgmUnlock(pVM);
1237	}
1238	AssertRCReturn(rc, rc);
1239	}
1240	else
1241	{
1242	/*
1243	* No RAM range, insert an ad-hoc one.
1244	*
1245	* Note that we don't have to tell REM about this range because
1246	* PGMHandlerPhysicalRegisterEx will do that for us.
1247	*/
1248	Log(("PGMR3PhysMMIORegister: Adding ad-hoc MMIO range for %RGp-%RGp %s\n", GCPhys, GCPhysLast, pszDesc));
1249
1250	const uint32_t cPages = cb >> PAGE_SHIFT;
1251	const size_t cbRamRange = RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]);
1252	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]), 16, MM_TAG_PGM_PHYS, (void **)&pNew);
1253	AssertLogRelMsgRCReturn(rc, ("cbRamRange=%zu\n", cbRamRange), rc);
1254
1255	/* Initialize the range. */
1256	pNew->pSelfR0 = MMHyperCCToR0(pVM, pNew);
1257	pNew->pSelfRC = MMHyperCCToRC(pVM, pNew);
1258	pNew->GCPhys = GCPhys;
1259	pNew->GCPhysLast = GCPhysLast;
1260	pNew->cb = cb;
1261	pNew->pszDesc = pszDesc;
1262	pNew->fFlags = 0; /** @todo add some kind of ad-hoc flag? */
1263
1264	pNew->pvR3 = NULL;
1265
1266	uint32_t iPage = cPages;
1267	while (iPage-- > 0)
1268	PGM_PAGE_INIT_ZERO_REAL(&pNew->aPages[iPage], pVM, PGMPAGETYPE_MMIO);
1269	Assert(PGM_PAGE_GET_TYPE(&pNew->aPages[0]) == PGMPAGETYPE_MMIO);
1270
1271	/* update the page count stats. */
1272	pVM->pgm.s.cZeroPages += cPages;
1273	pVM->pgm.s.cAllPages += cPages;
1274
1275	/* link it */
1276	pgmR3PhysLinkRamRange(pVM, pNew, pRamPrev);
1277	}
1278
1279	/*
1280	* Register the access handler.
1281	*/
1282	rc = PGMHandlerPhysicalRegisterEx(pVM, PGMPHYSHANDLERTYPE_MMIO, GCPhys, GCPhysLast,
1283	pfnHandlerR3, pvUserR3,
1284	pfnHandlerR0, pvUserR0,
1285	pfnHandlerRC, pvUserRC, pszDesc);
1286	if ( RT_FAILURE(rc)
1287	&& !fRamExists)
1288	{
1289	pVM->pgm.s.cZeroPages -= cb >> PAGE_SHIFT;
1290	pVM->pgm.s.cAllPages -= cb >> PAGE_SHIFT;
1291
1292	/* remove the ad-hoc range. */
1293	pgmR3PhysUnlinkRamRange2(pVM, pNew, pRamPrev);
1294	pNew->cb = pNew->GCPhys = pNew->GCPhysLast = NIL_RTGCPHYS;
1295	MMHyperFree(pVM, pRam);
1296	}
1297
1298	return rc;
1299	}
1300
1301
1302	/**
1303	* This is the interface IOM is using to register an MMIO region.
1304	*
1305	* It will take care of calling PGMHandlerPhysicalDeregister and clean up
1306	* any ad-hoc PGMRAMRANGE left behind.
1307	*
1308	* @returns VBox status code.
1309	* @param pVM Pointer to the shared VM structure.
1310	* @param GCPhys The start of the MMIO region.
1311	* @param cb The size of the MMIO region.
1312	*/
1313	VMMR3DECL(int) PGMR3PhysMMIODeregister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb)
1314	{
1315	VM_ASSERT_EMT(pVM);
1316
1317	/*
1318	* First deregister the handler, then check if we should remove the ram range.
1319	*/
1320	int rc = PGMHandlerPhysicalDeregister(pVM, GCPhys);
1321	if (RT_SUCCESS(rc))
1322	{
1323	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
1324	PPGMRAMRANGE pRamPrev = NULL;
1325	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1326	while (pRam && GCPhysLast >= pRam->GCPhys)
1327	{
1328	/** @todo We're being a bit too careful here. rewrite. */
1329	if ( GCPhysLast == pRam->GCPhysLast
1330	&& GCPhys == pRam->GCPhys)
1331	{
1332	Assert(pRam->cb == cb);
1333
1334	/*
1335	* See if all the pages are dead MMIO pages.
1336	*/
1337	uint32_t const cPages = cb >> PAGE_SHIFT;
1338	bool fAllMMIO = true;
1339	uint32_t iPage = 0;
1340	uint32_t cLeft = cPages;
1341	while (cLeft-- > 0)
1342	{
1343	PPGMPAGE pPage = &pRam->aPages[iPage];
1344	if ( PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO
1345	/\|\| not-out-of-action later /)
1346	{
1347	fAllMMIO = false;
1348	Assert(PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_MMIO2_ALIAS_MMIO);
1349	AssertMsgFailed(("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1350	break;
1351	}
1352	Assert(PGM_PAGE_IS_ZERO(pPage));
1353	pPage++;
1354	}
1355	if (fAllMMIO)
1356	{
1357	/*
1358	* Ad-hoc range, unlink and free it.
1359	*/
1360	Log(("PGMR3PhysMMIODeregister: Freeing ad-hoc MMIO range for %RGp-%RGp %s\n",
1361	GCPhys, GCPhysLast, pRam->pszDesc));
1362
1363	pVM->pgm.s.cAllPages -= cPages;
1364	pVM->pgm.s.cZeroPages -= cPages;
1365
1366	pgmR3PhysUnlinkRamRange2(pVM, pRam, pRamPrev);
1367	pRam->cb = pRam->GCPhys = pRam->GCPhysLast = NIL_RTGCPHYS;
1368	MMHyperFree(pVM, pRam);
1369	break;
1370	}
1371	}
1372
1373	/*
1374	* Range match? It will all be within one range (see PGMAllHandler.cpp).
1375	*/
1376	if ( GCPhysLast >= pRam->GCPhys
1377	&& GCPhys <= pRam->GCPhysLast)
1378	{
1379	Assert(GCPhys >= pRam->GCPhys);
1380	Assert(GCPhysLast <= pRam->GCPhysLast);
1381
1382	/*
1383	* Turn the pages back into RAM pages.
1384	*/
1385	uint32_t iPage = (GCPhys - pRam->GCPhys) >> PAGE_SHIFT;
1386	uint32_t cLeft = cb >> PAGE_SHIFT;
1387	while (cLeft--)
1388	{
1389	PPGMPAGE pPage = &pRam->aPages[iPage];
1390	AssertMsg(PGM_PAGE_IS_MMIO(pPage), ("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1391	AssertMsg(PGM_PAGE_IS_ZERO(pPage), ("%RGp %R[pgmpage]\n", pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), pPage));
1392	if (PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_MMIO)
1393	PGM_PAGE_SET_TYPE(pPage, PGMPAGETYPE_RAM);
1394	}
1395	break;
1396	}
1397
1398	/* next */
1399	pRamPrev = pRam;
1400	pRam = pRam->pNextR3;
1401	}
1402	}
1403
1404	return rc;
1405	}
1406
1407
1408	/**
1409	* Locate a MMIO2 range.
1410	*
1411	* @returns Pointer to the MMIO2 range.
1412	* @param pVM Pointer to the shared VM structure.
1413	* @param pDevIns The device instance owning the region.
1414	* @param iRegion The region.
1415	*/
1416	DECLINLINE(PPGMMMIO2RANGE) pgmR3PhysMMIO2Find(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion)
1417	{
1418	/*
1419	* Search the list.
1420	*/
1421	for (PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3; pCur; pCur = pCur->pNextR3)
1422	if ( pCur->pDevInsR3 == pDevIns
1423	&& pCur->iRegion == iRegion)
1424	return pCur;
1425	return NULL;
1426	}
1427
1428
1429	/**
1430	* Allocate and register an MMIO2 region.
1431	*
1432	* As mentioned elsewhere, MMIO2 is just RAM spelled differently. It's
1433	* RAM associated with a device. It is also non-shared memory with a
1434	* permanent ring-3 mapping and page backing (presently).
1435	*
1436	* A MMIO2 range may overlap with base memory if a lot of RAM
1437	* is configured for the VM, in which case we'll drop the base
1438	* memory pages. Presently we will make no attempt to preserve
1439	* anything that happens to be present in the base memory that
1440	* is replaced, this is of course incorrectly but it's too much
1441	* effort.
1442	*
1443	* @returns VBox status code.
1444	* @retval VINF_SUCCESS on success, *ppv pointing to the R3 mapping of the memory.
1445	* @retval VERR_ALREADY_EXISTS if the region already exists.
1446	*
1447	* @param pVM Pointer to the shared VM structure.
1448	* @param pDevIns The device instance owning the region.
1449	* @param iRegion The region number. If the MMIO2 memory is a PCI I/O region
1450	* this number has to be the number of that region. Otherwise
1451	* it can be any number safe UINT8_MAX.
1452	* @param cb The size of the region. Must be page aligned.
1453	* @param fFlags Reserved for future use, must be zero.
1454	* @param ppv Where to store the pointer to the ring-3 mapping of the memory.
1455	* @param pszDesc The description.
1456	*/
1457	VMMR3DECL(int) PGMR3PhysMMIO2Register(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS cb, uint32_t fFlags, void *ppv, const char pszDesc)
1458	{
1459	/*
1460	* Validate input.
1461	*/
1462	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1463	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1464	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1465	AssertPtrReturn(ppv, VERR_INVALID_POINTER);
1466	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
1467	AssertReturn(*pszDesc, VERR_INVALID_PARAMETER);
1468	AssertReturn(pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion) == NULL, VERR_ALREADY_EXISTS);
1469	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1470	AssertReturn(cb, VERR_INVALID_PARAMETER);
1471	AssertReturn(!fFlags, VERR_INVALID_PARAMETER);
1472
1473	const uint32_t cPages = cb >> PAGE_SHIFT;
1474	AssertLogRelReturn(((RTGCPHYS)cPages << PAGE_SHIFT) == cb, VERR_INVALID_PARAMETER);
1475	AssertLogRelReturn(cPages <= INT32_MAX / 2, VERR_NO_MEMORY);
1476
1477	/*
1478	* Try reserve and allocate the backing memory first as this is what is
1479	* most likely to fail.
1480	*/
1481	int rc = MMR3AdjustFixedReservation(pVM, cPages, pszDesc);
1482	if (RT_FAILURE(rc))
1483	return rc;
1484
1485	void *pvPages;
1486	PSUPPAGE paPages = (PSUPPAGE)RTMemTmpAlloc(cPages * sizeof(SUPPAGE));
1487	if (RT_SUCCESS(rc))
1488	rc = SUPR3PageAllocEx(cPages, 0 /fFlags/, &pvPages, NULL /pR0Ptr/, paPages);
1489	if (RT_SUCCESS(rc))
1490	{
1491	memset(pvPages, 0, cPages * PAGE_SIZE);
1492
1493	/*
1494	* Create the MMIO2 range record for it.
1495	*/
1496	const size_t cbRange = RT_OFFSETOF(PGMMMIO2RANGE, RamRange.aPages[cPages]);
1497	PPGMMMIO2RANGE pNew;
1498	rc = MMR3HyperAllocOnceNoRel(pVM, cbRange, 0, MM_TAG_PGM_PHYS, (void **)&pNew);
1499	AssertLogRelMsgRC(rc, ("cbRamRange=%zu\n", cbRange));
1500	if (RT_SUCCESS(rc))
1501	{
1502	pNew->pDevInsR3 = pDevIns;
1503	pNew->pvR3 = pvPages;
1504	//pNew->pNext = NULL;
1505	//pNew->fMapped = false;
1506	//pNew->fOverlapping = false;
1507	pNew->iRegion = iRegion;
1508	pNew->RamRange.pSelfR0 = MMHyperCCToR0(pVM, &pNew->RamRange);
1509	pNew->RamRange.pSelfRC = MMHyperCCToRC(pVM, &pNew->RamRange);
1510	pNew->RamRange.GCPhys = NIL_RTGCPHYS;
1511	pNew->RamRange.GCPhysLast = NIL_RTGCPHYS;
1512	pNew->RamRange.pszDesc = pszDesc;
1513	pNew->RamRange.cb = cb;
1514	//pNew->RamRange.fFlags = 0; /// @todo MMIO2 flag?
1515
1516	pNew->RamRange.pvR3 = pvPages;
1517
1518	uint32_t iPage = cPages;
1519	while (iPage-- > 0)
1520	{
1521	PGM_PAGE_INIT(&pNew->RamRange.aPages[iPage],
1522	paPages[iPage].Phys & X86_PTE_PAE_PG_MASK, NIL_GMM_PAGEID,
1523	PGMPAGETYPE_MMIO2, PGM_PAGE_STATE_ALLOCATED);
1524	}
1525
1526	/* update page count stats */
1527	pVM->pgm.s.cAllPages += cPages;
1528	pVM->pgm.s.cPrivatePages += cPages;
1529
1530	/*
1531	* Link it into the list.
1532	* Since there is no particular order, just push it.
1533	*/
1534	pNew->pNextR3 = pVM->pgm.s.pMmio2RangesR3;
1535	pVM->pgm.s.pMmio2RangesR3 = pNew;
1536
1537	*ppv = pvPages;
1538	RTMemTmpFree(paPages);
1539	return VINF_SUCCESS;
1540	}
1541
1542	SUPR3PageFreeEx(pvPages, cPages);
1543	}
1544	RTMemTmpFree(paPages);
1545	MMR3AdjustFixedReservation(pVM, -(int32_t)cPages, pszDesc);
1546	return rc;
1547	}
1548
1549
1550	/**
1551	* Deregisters and frees an MMIO2 region.
1552	*
1553	* Any physical (and virtual) access handlers registered for the region must
1554	* be deregistered before calling this function.
1555	*
1556	* @returns VBox status code.
1557	* @param pVM Pointer to the shared VM structure.
1558	* @param pDevIns The device instance owning the region.
1559	* @param iRegion The region. If it's UINT32_MAX it'll be a wildcard match.
1560	*/
1561	VMMR3DECL(int) PGMR3PhysMMIO2Deregister(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion)
1562	{
1563	/*
1564	* Validate input.
1565	*/
1566	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1567	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1568	AssertReturn(iRegion <= UINT8_MAX \|\| iRegion == UINT32_MAX, VERR_INVALID_PARAMETER);
1569
1570	int rc = VINF_SUCCESS;
1571	unsigned cFound = 0;
1572	PPGMMMIO2RANGE pPrev = NULL;
1573	PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3;
1574	while (pCur)
1575	{
1576	if ( pCur->pDevInsR3 == pDevIns
1577	&& ( iRegion == UINT32_MAX
1578	\|\| pCur->iRegion == iRegion))
1579	{
1580	cFound++;
1581
1582	/*
1583	* Unmap it if it's mapped.
1584	*/
1585	if (pCur->fMapped)
1586	{
1587	int rc2 = PGMR3PhysMMIO2Unmap(pVM, pCur->pDevInsR3, pCur->iRegion, pCur->RamRange.GCPhys);
1588	AssertRC(rc2);
1589	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1590	rc = rc2;
1591	}
1592
1593	/*
1594	* Unlink it
1595	*/
1596	PPGMMMIO2RANGE pNext = pCur->pNextR3;
1597	if (pPrev)
1598	pPrev->pNextR3 = pNext;
1599	else
1600	pVM->pgm.s.pMmio2RangesR3 = pNext;
1601	pCur->pNextR3 = NULL;
1602
1603	/*
1604	* Free the memory.
1605	*/
1606	int rc2 = SUPR3PageFreeEx(pCur->pvR3, pCur->RamRange.cb >> PAGE_SHIFT);
1607	AssertRC(rc2);
1608	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1609	rc = rc2;
1610
1611	uint32_t const cPages = pCur->RamRange.cb >> PAGE_SHIFT;
1612	rc2 = MMR3AdjustFixedReservation(pVM, -(int32_t)cPages, pCur->RamRange.pszDesc);
1613	AssertRC(rc2);
1614	if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
1615	rc = rc2;
1616
1617	/* we're leaking hyper memory here if done at runtime. */
1618	Assert( VMR3GetState(pVM) == VMSTATE_OFF
1619	\|\| VMR3GetState(pVM) == VMSTATE_DESTROYING
1620	\|\| VMR3GetState(pVM) == VMSTATE_TERMINATED
1621	\|\| VMR3GetState(pVM) == VMSTATE_CREATING);
1622	/*rc = MMHyperFree(pVM, pCur);
1623	AssertRCReturn(rc, rc); - not safe, see the alloc call. */
1624
1625
1626	/* update page count stats */
1627	pVM->pgm.s.cAllPages -= cPages;
1628	pVM->pgm.s.cPrivatePages -= cPages;
1629
1630	/* next */
1631	pCur = pNext;
1632	}
1633	else
1634	{
1635	pPrev = pCur;
1636	pCur = pCur->pNextR3;
1637	}
1638	}
1639
1640	return !cFound && iRegion != UINT32_MAX ? VERR_NOT_FOUND : rc;
1641	}
1642
1643
1644	/**
1645	* Maps a MMIO2 region.
1646	*
1647	* This is done when a guest / the bios / state loading changes the
1648	* PCI config. The replacing of base memory has the same restrictions
1649	* as during registration, of course.
1650	*
1651	* @returns VBox status code.
1652	*
1653	* @param pVM Pointer to the shared VM structure.
1654	* @param pDevIns The
1655	*/
1656	VMMR3DECL(int) PGMR3PhysMMIO2Map(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys)
1657	{
1658	/*
1659	* Validate input
1660	*/
1661	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1662	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1663	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1664	AssertReturn(GCPhys != NIL_RTGCPHYS, VERR_INVALID_PARAMETER);
1665	AssertReturn(GCPhys != 0, VERR_INVALID_PARAMETER);
1666	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1667
1668	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1669	AssertReturn(pCur, VERR_NOT_FOUND);
1670	AssertReturn(!pCur->fMapped, VERR_WRONG_ORDER);
1671	Assert(pCur->RamRange.GCPhys == NIL_RTGCPHYS);
1672	Assert(pCur->RamRange.GCPhysLast == NIL_RTGCPHYS);
1673
1674	const RTGCPHYS GCPhysLast = GCPhys + pCur->RamRange.cb - 1;
1675	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
1676
1677	/*
1678	* Find our location in the ram range list, checking for
1679	* restriction we don't bother implementing yet (partially overlapping).
1680	*/
1681	bool fRamExists = false;
1682	PPGMRAMRANGE pRamPrev = NULL;
1683	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1684	while (pRam && GCPhysLast >= pRam->GCPhys)
1685	{
1686	if ( GCPhys <= pRam->GCPhysLast
1687	&& GCPhysLast >= pRam->GCPhys)
1688	{
1689	/* completely within? */
1690	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
1691	&& GCPhysLast <= pRam->GCPhysLast,
1692	("%RGp-%RGp (MMIO2/%s) falls partly outside %RGp-%RGp (%s)\n",
1693	GCPhys, GCPhysLast, pCur->RamRange.pszDesc,
1694	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
1695	VERR_PGM_RAM_CONFLICT);
1696	fRamExists = true;
1697	break;
1698	}
1699
1700	/* next */
1701	pRamPrev = pRam;
1702	pRam = pRam->pNextR3;
1703	}
1704	if (fRamExists)
1705	{
1706	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1707	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1708	while (cPagesLeft-- > 0)
1709	{
1710	AssertLogRelMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM,
1711	("%RGp isn't a RAM page (%d) - mapping %RGp-%RGp (MMIO2/%s).\n",
1712	GCPhys, PGM_PAGE_GET_TYPE(pPage), GCPhys, GCPhysLast, pCur->RamRange.pszDesc),
1713	VERR_PGM_RAM_CONFLICT);
1714	pPage++;
1715	}
1716	}
1717	Log(("PGMR3PhysMMIO2Map: %RGp-%RGp fRamExists=%RTbool %s\n",
1718	GCPhys, GCPhysLast, fRamExists, pCur->RamRange.pszDesc));
1719
1720	/*
1721	* Make the changes.
1722	*/
1723	pgmLock(pVM);
1724
1725	pCur->RamRange.GCPhys = GCPhys;
1726	pCur->RamRange.GCPhysLast = GCPhysLast;
1727	pCur->fMapped = true;
1728	pCur->fOverlapping = fRamExists;
1729
1730	if (fRamExists)
1731	{
1732	/** @todo use pgmR3PhysFreePageRange here. */
1733	uint32_t cPendingPages = 0;
1734	PGMMFREEPAGESREQ pReq;
1735	int rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
1736	AssertLogRelRCReturn(rc, rc);
1737
1738	/* replace the pages, freeing all present RAM pages. */
1739	PPGMPAGE pPageSrc = &pCur->RamRange.aPages[0];
1740	PPGMPAGE pPageDst = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1741	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1742	while (cPagesLeft-- > 0)
1743	{
1744	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, pPageDst, GCPhys);
1745	AssertLogRelRCReturn(rc, rc); /* We're done for if this goes wrong. */
1746
1747	RTHCPHYS const HCPhys = PGM_PAGE_GET_HCPHYS(pPageSrc);
1748	PGM_PAGE_SET_HCPHYS(pPageDst, HCPhys);
1749	PGM_PAGE_SET_TYPE(pPageDst, PGMPAGETYPE_MMIO2);
1750	PGM_PAGE_SET_STATE(pPageDst, PGM_PAGE_STATE_ALLOCATED);
1751
1752	pVM->pgm.s.cZeroPages--;
1753	GCPhys += PAGE_SIZE;
1754	pPageSrc++;
1755	pPageDst++;
1756	}
1757
1758	if (cPendingPages)
1759	{
1760	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
1761	AssertLogRelRCReturn(rc, rc);
1762	}
1763	GMMR3FreePagesCleanup(pReq);
1764	}
1765	else
1766	{
1767	/* link in the ram range */
1768	pgmR3PhysLinkRamRange(pVM, &pCur->RamRange, pRamPrev);
1769	REMR3NotifyPhysRamRegister(pVM, GCPhys, pCur->RamRange.cb, REM_NOTIFY_PHYS_RAM_FLAGS_MMIO2);
1770	}
1771
1772	pgmUnlock(pVM);
1773
1774	return VINF_SUCCESS;
1775	}
1776
1777
1778	/**
1779	* Unmaps a MMIO2 region.
1780	*
1781	* This is done when a guest / the bios / state loading changes the
1782	* PCI config. The replacing of base memory has the same restrictions
1783	* as during registration, of course.
1784	*/
1785	VMMR3DECL(int) PGMR3PhysMMIO2Unmap(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys)
1786	{
1787	/*
1788	* Validate input
1789	*/
1790	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1791	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1792	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1793	AssertReturn(GCPhys != NIL_RTGCPHYS, VERR_INVALID_PARAMETER);
1794	AssertReturn(GCPhys != 0, VERR_INVALID_PARAMETER);
1795	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
1796
1797	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1798	AssertReturn(pCur, VERR_NOT_FOUND);
1799	AssertReturn(pCur->fMapped, VERR_WRONG_ORDER);
1800	AssertReturn(pCur->RamRange.GCPhys == GCPhys, VERR_INVALID_PARAMETER);
1801	Assert(pCur->RamRange.GCPhysLast != NIL_RTGCPHYS);
1802
1803	Log(("PGMR3PhysMMIO2Unmap: %RGp-%RGp %s\n",
1804	pCur->RamRange.GCPhys, pCur->RamRange.GCPhysLast, pCur->RamRange.pszDesc));
1805
1806	/*
1807	* Unmap it.
1808	*/
1809	pgmLock(pVM);
1810
1811	if (pCur->fOverlapping)
1812	{
1813	/* Restore the RAM pages we've replaced. */
1814	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
1815	while (pRam->GCPhys > pCur->RamRange.GCPhysLast)
1816	pRam = pRam->pNextR3;
1817
1818	RTHCPHYS const HCPhysZeroPg = pVM->pgm.s.HCPhysZeroPg;
1819	Assert(HCPhysZeroPg != 0 && HCPhysZeroPg != NIL_RTHCPHYS);
1820	PPGMPAGE pPageDst = &pRam->aPages[(pCur->RamRange.GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
1821	uint32_t cPagesLeft = pCur->RamRange.cb >> PAGE_SHIFT;
1822	while (cPagesLeft-- > 0)
1823	{
1824	PGM_PAGE_SET_HCPHYS(pPageDst, HCPhysZeroPg);
1825	PGM_PAGE_SET_TYPE(pPageDst, PGMPAGETYPE_RAM);
1826	PGM_PAGE_SET_STATE(pPageDst, PGM_PAGE_STATE_ZERO);
1827	PGM_PAGE_SET_PAGEID(pPageDst, NIL_GMM_PAGEID);
1828
1829	pVM->pgm.s.cZeroPages++;
1830	pPageDst++;
1831	}
1832	}
1833	else
1834	{
1835	REMR3NotifyPhysRamDeregister(pVM, pCur->RamRange.GCPhys, pCur->RamRange.cb);
1836	pgmR3PhysUnlinkRamRange(pVM, &pCur->RamRange);
1837	}
1838
1839	pCur->RamRange.GCPhys = NIL_RTGCPHYS;
1840	pCur->RamRange.GCPhysLast = NIL_RTGCPHYS;
1841	pCur->fOverlapping = false;
1842	pCur->fMapped = false;
1843
1844	pgmUnlock(pVM);
1845
1846	return VINF_SUCCESS;
1847	}
1848
1849
1850	/**
1851	* Checks if the given address is an MMIO2 base address or not.
1852	*
1853	* @returns true/false accordingly.
1854	* @param pVM Pointer to the shared VM structure.
1855	* @param pDevIns The owner of the memory, optional.
1856	* @param GCPhys The address to check.
1857	*/
1858	VMMR3DECL(bool) PGMR3PhysMMIO2IsBase(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhys)
1859	{
1860	/*
1861	* Validate input
1862	*/
1863	VM_ASSERT_EMT_RETURN(pVM, false);
1864	AssertPtrReturn(pDevIns, false);
1865	AssertReturn(GCPhys != NIL_RTGCPHYS, false);
1866	AssertReturn(GCPhys != 0, false);
1867	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), false);
1868
1869	/*
1870	* Search the list.
1871	*/
1872	for (PPGMMMIO2RANGE pCur = pVM->pgm.s.pMmio2RangesR3; pCur; pCur = pCur->pNextR3)
1873	if (pCur->RamRange.GCPhys == GCPhys)
1874	{
1875	Assert(pCur->fMapped);
1876	return true;
1877	}
1878	return false;
1879	}
1880
1881
1882	/**
1883	* Gets the HC physical address of a page in the MMIO2 region.
1884	*
1885	* This is API is intended for MMHyper and shouldn't be called
1886	* by anyone else...
1887	*
1888	* @returns VBox status code.
1889	* @param pVM Pointer to the shared VM structure.
1890	* @param pDevIns The owner of the memory, optional.
1891	* @param iRegion The region.
1892	* @param off The page expressed an offset into the MMIO2 region.
1893	* @param pHCPhys Where to store the result.
1894	*/
1895	VMMR3DECL(int) PGMR3PhysMMIO2GetHCPhys(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, PRTHCPHYS pHCPhys)
1896	{
1897	/*
1898	* Validate input
1899	*/
1900	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1901	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1902	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1903
1904	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1905	AssertReturn(pCur, VERR_NOT_FOUND);
1906	AssertReturn(off < pCur->RamRange.cb, VERR_INVALID_PARAMETER);
1907
1908	PCPGMPAGE pPage = &pCur->RamRange.aPages[off >> PAGE_SHIFT];
1909	*pHCPhys = PGM_PAGE_GET_HCPHYS(pPage);
1910	return VINF_SUCCESS;
1911	}
1912
1913
1914	/**
1915	* Maps a portion of an MMIO2 region into kernel space (host).
1916	*
1917	* The kernel mapping will become invalid when the MMIO2 memory is deregistered
1918	* or the VM is terminated.
1919	*
1920	* @return VBox status code.
1921	*
1922	* @param pVM Pointer to the shared VM structure.
1923	* @param pDevIns The device owning the MMIO2 memory.
1924	* @param iRegion The region.
1925	* @param off The offset into the region. Must be page aligned.
1926	* @param cb The number of bytes to map. Must be page aligned.
1927	* @param pszDesc Mapping description.
1928	* @param pR0Ptr Where to store the R0 address.
1929	*/
1930	VMMR3DECL(int) PGMR3PhysMMIO2MapKernel(PVM pVM, PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, RTGCPHYS cb,
1931	const char *pszDesc, PRTR0PTR pR0Ptr)
1932	{
1933	/*
1934	* Validate input.
1935	*/
1936	VM_ASSERT_EMT_RETURN(pVM, VERR_VM_THREAD_NOT_EMT);
1937	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1938	AssertReturn(iRegion <= UINT8_MAX, VERR_INVALID_PARAMETER);
1939
1940	PPGMMMIO2RANGE pCur = pgmR3PhysMMIO2Find(pVM, pDevIns, iRegion);
1941	AssertReturn(pCur, VERR_NOT_FOUND);
1942	AssertReturn(off < pCur->RamRange.cb, VERR_INVALID_PARAMETER);
1943	AssertReturn(cb <= pCur->RamRange.cb, VERR_INVALID_PARAMETER);
1944	AssertReturn(off + cb <= pCur->RamRange.cb, VERR_INVALID_PARAMETER);
1945
1946	/*
1947	* Pass the request on to the support library/driver.
1948	*/
1949	int rc = SUPR3PageMapKernel(pCur->pvR3, off, cb, 0, pR0Ptr);
1950
1951	return rc;
1952	}
1953
1954
1955	/**
1956	* Registers a ROM image.
1957	*
1958	* Shadowed ROM images requires double the amount of backing memory, so,
1959	* don't use that unless you have to. Shadowing of ROM images is process
1960	* where we can select where the reads go and where the writes go. On real
1961	* hardware the chipset provides means to configure this. We provide
1962	* PGMR3PhysProtectROM() for this purpose.
1963	*
1964	* A read-only copy of the ROM image will always be kept around while we
1965	* will allocate RAM pages for the changes on demand (unless all memory
1966	* is configured to be preallocated).
1967	*
1968	* @returns VBox status.
1969	* @param pVM VM Handle.
1970	* @param pDevIns The device instance owning the ROM.
1971	* @param GCPhys First physical address in the range.
1972	* Must be page aligned!
1973	* @param cbRange The size of the range (in bytes).
1974	* Must be page aligned!
1975	* @param pvBinary Pointer to the binary data backing the ROM image.
1976	* This must be exactly \a cbRange in size.
1977	* @param fFlags Mask of flags. PGMPHYS_ROM_FLAGS_SHADOWED
1978	* and/or PGMPHYS_ROM_FLAGS_PERMANENT_BINARY.
1979	* @param pszDesc Pointer to description string. This must not be freed.
1980	*
1981	* @remark There is no way to remove the rom, automatically on device cleanup or
1982	* manually from the device yet. This isn't difficult in any way, it's
1983	* just not something we expect to be necessary for a while.
1984	*/
1985	VMMR3DECL(int) PGMR3PhysRomRegister(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTGCPHYS cb,
1986	const void pvBinary, uint32_t fFlags, const char pszDesc)
1987	{
1988	Log(("PGMR3PhysRomRegister: pDevIns=%p GCPhys=%RGp(-%RGp) cb=%RGp pvBinary=%p fFlags=%#x pszDesc=%s\n",
1989	pDevIns, GCPhys, GCPhys + cb, cb, pvBinary, fFlags, pszDesc));
1990
1991	/*
1992	* Validate input.
1993	*/
1994	AssertPtrReturn(pDevIns, VERR_INVALID_PARAMETER);
1995	AssertReturn(RT_ALIGN_T(GCPhys, PAGE_SIZE, RTGCPHYS) == GCPhys, VERR_INVALID_PARAMETER);
1996	AssertReturn(RT_ALIGN_T(cb, PAGE_SIZE, RTGCPHYS) == cb, VERR_INVALID_PARAMETER);
1997	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
1998	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
1999	AssertPtrReturn(pvBinary, VERR_INVALID_PARAMETER);
2000	AssertPtrReturn(pszDesc, VERR_INVALID_POINTER);
2001	AssertReturn(!(fFlags & ~(PGMPHYS_ROM_FLAGS_SHADOWED \| PGMPHYS_ROM_FLAGS_PERMANENT_BINARY)), VERR_INVALID_PARAMETER);
2002	VM_ASSERT_STATE_RETURN(pVM, VMSTATE_CREATING, VERR_VM_INVALID_VM_STATE);
2003
2004	const uint32_t cPages = cb >> PAGE_SHIFT;
2005
2006	/*
2007	* Find the ROM location in the ROM list first.
2008	*/
2009	PPGMROMRANGE pRomPrev = NULL;
2010	PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3;
2011	while (pRom && GCPhysLast >= pRom->GCPhys)
2012	{
2013	if ( GCPhys <= pRom->GCPhysLast
2014	&& GCPhysLast >= pRom->GCPhys)
2015	AssertLogRelMsgFailedReturn(("%RGp-%RGp (%s) conflicts with existing %RGp-%RGp (%s)\n",
2016	GCPhys, GCPhysLast, pszDesc,
2017	pRom->GCPhys, pRom->GCPhysLast, pRom->pszDesc),
2018	VERR_PGM_RAM_CONFLICT);
2019	/* next */
2020	pRomPrev = pRom;
2021	pRom = pRom->pNextR3;
2022	}
2023
2024	/*
2025	* Find the RAM location and check for conflicts.
2026	*
2027	* Conflict detection is a bit different than for RAM
2028	* registration since a ROM can be located within a RAM
2029	* range. So, what we have to check for is other memory
2030	* types (other than RAM that is) and that we don't span
2031	* more than one RAM range (layz).
2032	*/
2033	bool fRamExists = false;
2034	PPGMRAMRANGE pRamPrev = NULL;
2035	PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
2036	while (pRam && GCPhysLast >= pRam->GCPhys)
2037	{
2038	if ( GCPhys <= pRam->GCPhysLast
2039	&& GCPhysLast >= pRam->GCPhys)
2040	{
2041	/* completely within? */
2042	AssertLogRelMsgReturn( GCPhys >= pRam->GCPhys
2043	&& GCPhysLast <= pRam->GCPhysLast,
2044	("%RGp-%RGp (%s) falls partly outside %RGp-%RGp (%s)\n",
2045	GCPhys, GCPhysLast, pszDesc,
2046	pRam->GCPhys, pRam->GCPhysLast, pRam->pszDesc),
2047	VERR_PGM_RAM_CONFLICT);
2048	fRamExists = true;
2049	break;
2050	}
2051
2052	/* next */
2053	pRamPrev = pRam;
2054	pRam = pRam->pNextR3;
2055	}
2056	if (fRamExists)
2057	{
2058	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
2059	uint32_t cPagesLeft = cPages;
2060	while (cPagesLeft-- > 0)
2061	{
2062	AssertLogRelMsgReturn(PGM_PAGE_GET_TYPE(pPage) == PGMPAGETYPE_RAM,
2063	("%RGp (%R[pgmpage]) isn't a RAM page - registering %RGp-%RGp (%s).\n",
2064	pRam->GCPhys + ((RTGCPHYS)(uintptr_t)(pPage - &pRam->aPages[0]) << PAGE_SHIFT),
2065	pPage, GCPhys, GCPhysLast, pszDesc), VERR_PGM_RAM_CONFLICT);
2066	Assert(PGM_PAGE_IS_ZERO(pPage));
2067	pPage++;
2068	}
2069	}
2070
2071	/*
2072	* Update the base memory reservation if necessary.
2073	*/
2074	uint32_t cExtraBaseCost = fRamExists ? cPages : 0;
2075	if (fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2076	cExtraBaseCost += cPages;
2077	if (cExtraBaseCost)
2078	{
2079	int rc = MMR3IncreaseBaseReservation(pVM, cExtraBaseCost);
2080	if (RT_FAILURE(rc))
2081	return rc;
2082	}
2083
2084	/*
2085	* Allocate memory for the virgin copy of the RAM.
2086	*/
2087	PGMMALLOCATEPAGESREQ pReq;
2088	int rc = GMMR3AllocatePagesPrepare(pVM, &pReq, cPages, GMMACCOUNT_BASE);
2089	AssertRCReturn(rc, rc);
2090
2091	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2092	{
2093	pReq->aPages[iPage].HCPhysGCPhys = GCPhys + (iPage << PAGE_SHIFT);
2094	pReq->aPages[iPage].idPage = NIL_GMM_PAGEID;
2095	pReq->aPages[iPage].idSharedPage = NIL_GMM_PAGEID;
2096	}
2097
2098	pgmLock(pVM);
2099	rc = GMMR3AllocatePagesPerform(pVM, pReq);
2100	pgmUnlock(pVM);
2101	if (RT_FAILURE(rc))
2102	{
2103	GMMR3AllocatePagesCleanup(pReq);
2104	return rc;
2105	}
2106
2107	/*
2108	* Allocate the new ROM range and RAM range (if necessary).
2109	*/
2110	PPGMROMRANGE pRomNew;
2111	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMROMRANGE, aPages[cPages]), 0, MM_TAG_PGM_PHYS, (void **)&pRomNew);
2112	if (RT_SUCCESS(rc))
2113	{
2114	PPGMRAMRANGE pRamNew = NULL;
2115	if (!fRamExists)
2116	rc = MMHyperAlloc(pVM, RT_OFFSETOF(PGMRAMRANGE, aPages[cPages]), sizeof(PGMPAGE), MM_TAG_PGM_PHYS, (void **)&pRamNew);
2117	if (RT_SUCCESS(rc))
2118	{
2119	pgmLock(pVM);
2120
2121	/*
2122	* Initialize and insert the RAM range (if required).
2123	*/
2124	PPGMROMPAGE pRomPage = &pRomNew->aPages[0];
2125	if (!fRamExists)
2126	{
2127	pRamNew->pSelfR0 = MMHyperCCToR0(pVM, pRamNew);
2128	pRamNew->pSelfRC = MMHyperCCToRC(pVM, pRamNew);
2129	pRamNew->GCPhys = GCPhys;
2130	pRamNew->GCPhysLast = GCPhysLast;
2131	pRamNew->cb = cb;
2132	pRamNew->pszDesc = pszDesc;
2133	pRamNew->fFlags = 0;
2134	pRamNew->pvR3 = NULL;
2135
2136	PPGMPAGE pPage = &pRamNew->aPages[0];
2137	for (uint32_t iPage = 0; iPage < cPages; iPage++, pPage++, pRomPage++)
2138	{
2139	PGM_PAGE_INIT(pPage,
2140	pReq->aPages[iPage].HCPhysGCPhys,
2141	pReq->aPages[iPage].idPage,
2142	PGMPAGETYPE_ROM,
2143	PGM_PAGE_STATE_ALLOCATED);
2144
2145	pRomPage->Virgin = *pPage;
2146	}
2147
2148	pVM->pgm.s.cAllPages += cPages;
2149	pgmR3PhysLinkRamRange(pVM, pRamNew, pRamPrev);
2150	}
2151	else
2152	{
2153	PPGMPAGE pPage = &pRam->aPages[(GCPhys - pRam->GCPhys) >> PAGE_SHIFT];
2154	for (uint32_t iPage = 0; iPage < cPages; iPage++, pPage++, pRomPage++)
2155	{
2156	PGM_PAGE_SET_TYPE(pPage, PGMPAGETYPE_ROM);
2157	PGM_PAGE_SET_HCPHYS(pPage, pReq->aPages[iPage].HCPhysGCPhys);
2158	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ALLOCATED);
2159	PGM_PAGE_SET_PAGEID(pPage, pReq->aPages[iPage].idPage);
2160
2161	pRomPage->Virgin = *pPage;
2162	}
2163
2164	pRamNew = pRam;
2165
2166	pVM->pgm.s.cZeroPages -= cPages;
2167	}
2168	pVM->pgm.s.cPrivatePages += cPages;
2169
2170	pgmUnlock(pVM);
2171
2172
2173	/*
2174	* !HACK ALERT! REM + (Shadowed) ROM ==> mess.
2175	*
2176	* If it's shadowed we'll register the handler after the ROM notification
2177	* so we get the access handler callbacks that we should. If it isn't
2178	* shadowed we'll do it the other way around to make REM use the built-in
2179	* ROM behavior and not the handler behavior (which is to route all access
2180	* to PGM atm).
2181	*/
2182	if (fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2183	{
2184	REMR3NotifyPhysRomRegister(pVM, GCPhys, cb, NULL, true /* fShadowed */);
2185	rc = PGMR3HandlerPhysicalRegister(pVM,
2186	fFlags & PGMPHYS_ROM_FLAGS_SHADOWED
2187	? PGMPHYSHANDLERTYPE_PHYSICAL_ALL
2188	: PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
2189	GCPhys, GCPhysLast,
2190	pgmR3PhysRomWriteHandler, pRomNew,
2191	NULL, "pgmPhysRomWriteHandler", MMHyperCCToR0(pVM, pRomNew),
2192	NULL, "pgmPhysRomWriteHandler", MMHyperCCToRC(pVM, pRomNew), pszDesc);
2193	}
2194	else
2195	{
2196	rc = PGMR3HandlerPhysicalRegister(pVM,
2197	fFlags & PGMPHYS_ROM_FLAGS_SHADOWED
2198	? PGMPHYSHANDLERTYPE_PHYSICAL_ALL
2199	: PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
2200	GCPhys, GCPhysLast,
2201	pgmR3PhysRomWriteHandler, pRomNew,
2202	NULL, "pgmPhysRomWriteHandler", MMHyperCCToR0(pVM, pRomNew),
2203	NULL, "pgmPhysRomWriteHandler", MMHyperCCToRC(pVM, pRomNew), pszDesc);
2204	REMR3NotifyPhysRomRegister(pVM, GCPhys, cb, NULL, false /* fShadowed */);
2205	}
2206	if (RT_SUCCESS(rc))
2207	{
2208	pgmLock(pVM);
2209
2210	/*
2211	* Copy the image over to the virgin pages.
2212	* This must be done after linking in the RAM range.
2213	*/
2214	PPGMPAGE pRamPage = &pRamNew->aPages[(GCPhys - pRamNew->GCPhys) >> PAGE_SHIFT];
2215	for (uint32_t iPage = 0; iPage < cPages; iPage++, pRamPage++)
2216	{
2217	void *pvDstPage;
2218	PPGMPAGEMAP pMapIgnored;
2219	rc = pgmPhysPageMap(pVM, pRamPage, GCPhys + (iPage << PAGE_SHIFT), &pMapIgnored, &pvDstPage);
2220	if (RT_FAILURE(rc))
2221	{
2222	VMSetError(pVM, rc, RT_SRC_POS, "Failed to map virgin ROM page at %RGp", GCPhys);
2223	break;
2224	}
2225	memcpy(pvDstPage, (const uint8_t *)pvBinary + (iPage << PAGE_SHIFT), PAGE_SIZE);
2226	}
2227	if (RT_SUCCESS(rc))
2228	{
2229	/*
2230	* Initialize the ROM range.
2231	* Note that the Virgin member of the pages has already been initialized above.
2232	*/
2233	pRomNew->GCPhys = GCPhys;
2234	pRomNew->GCPhysLast = GCPhysLast;
2235	pRomNew->cb = cb;
2236	pRomNew->fFlags = fFlags;
2237	pRomNew->pvOriginal = fFlags & PGMPHYS_ROM_FLAGS_PERMANENT_BINARY ? pvBinary : NULL;
2238	pRomNew->pszDesc = pszDesc;
2239
2240	for (unsigned iPage = 0; iPage < cPages; iPage++)
2241	{
2242	PPGMROMPAGE pPage = &pRomNew->aPages[iPage];
2243	pPage->enmProt = PGMROMPROT_READ_ROM_WRITE_IGNORE;
2244	PGM_PAGE_INIT_ZERO_REAL(&pPage->Shadow, pVM, PGMPAGETYPE_ROM_SHADOW);
2245	}
2246
2247	/* update the page count stats */
2248	pVM->pgm.s.cZeroPages += cPages;
2249	pVM->pgm.s.cAllPages += cPages;
2250
2251	/*
2252	* Insert the ROM range, tell REM and return successfully.
2253	*/
2254	pRomNew->pNextR3 = pRom;
2255	pRomNew->pNextR0 = pRom ? MMHyperCCToR0(pVM, pRom) : NIL_RTR0PTR;
2256	pRomNew->pNextRC = pRom ? MMHyperCCToRC(pVM, pRom) : NIL_RTRCPTR;
2257
2258	if (pRomPrev)
2259	{
2260	pRomPrev->pNextR3 = pRomNew;
2261	pRomPrev->pNextR0 = MMHyperCCToR0(pVM, pRomNew);
2262	pRomPrev->pNextRC = MMHyperCCToRC(pVM, pRomNew);
2263	}
2264	else
2265	{
2266	pVM->pgm.s.pRomRangesR3 = pRomNew;
2267	pVM->pgm.s.pRomRangesR0 = MMHyperCCToR0(pVM, pRomNew);
2268	pVM->pgm.s.pRomRangesRC = MMHyperCCToRC(pVM, pRomNew);
2269	}
2270
2271	GMMR3AllocatePagesCleanup(pReq);
2272	pgmUnlock(pVM);
2273	return VINF_SUCCESS;
2274	}
2275
2276	/* bail out */
2277
2278	pgmUnlock(pVM);
2279	int rc2 = PGMHandlerPhysicalDeregister(pVM, GCPhys);
2280	AssertRC(rc2);
2281	pgmLock(pVM);
2282	}
2283
2284	if (!fRamExists)
2285	{
2286	pgmR3PhysUnlinkRamRange2(pVM, pRamNew, pRamPrev);
2287	MMHyperFree(pVM, pRamNew);
2288	}
2289	}
2290	MMHyperFree(pVM, pRomNew);
2291	}
2292
2293	/** @todo Purge the mapping cache or something... */
2294	GMMR3FreeAllocatedPages(pVM, pReq);
2295	GMMR3AllocatePagesCleanup(pReq);
2296	pgmUnlock(pVM);
2297	return rc;
2298	}
2299
2300
2301	/**
2302	* \#PF Handler callback for ROM write accesses.
2303	*
2304	* @returns VINF_SUCCESS if the handler have carried out the operation.
2305	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
2306	* @param pVM VM Handle.
2307	* @param GCPhys The physical address the guest is writing to.
2308	* @param pvPhys The HC mapping of that address.
2309	* @param pvBuf What the guest is reading/writing.
2310	* @param cbBuf How much it's reading/writing.
2311	* @param enmAccessType The access type.
2312	* @param pvUser User argument.
2313	*/
2314	static DECLCALLBACK(int) pgmR3PhysRomWriteHandler(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
2315	{
2316	PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
2317	const uint32_t iPage = (GCPhys - pRom->GCPhys) >> PAGE_SHIFT;
2318	Assert(iPage < (pRom->cb >> PAGE_SHIFT));
2319	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
2320	Log5(("pgmR3PhysRomWriteHandler: %d %c %#08RGp %#04zx\n", pRomPage->enmProt, enmAccessType == PGMACCESSTYPE_READ ? 'R' : 'W', GCPhys, cbBuf));
2321
2322	if (enmAccessType == PGMACCESSTYPE_READ)
2323	{
2324	switch (pRomPage->enmProt)
2325	{
2326	/*
2327	* Take the default action.
2328	*/
2329	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
2330	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
2331	case PGMROMPROT_READ_ROM_WRITE_RAM:
2332	case PGMROMPROT_READ_RAM_WRITE_RAM:
2333	return VINF_PGM_HANDLER_DO_DEFAULT;
2334
2335	default:
2336	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
2337	pRom->aPages[iPage].enmProt, iPage, GCPhys),
2338	VERR_INTERNAL_ERROR);
2339	}
2340	}
2341	else
2342	{
2343	Assert(enmAccessType == PGMACCESSTYPE_WRITE);
2344	switch (pRomPage->enmProt)
2345	{
2346	/*
2347	* Ignore writes.
2348	*/
2349	case PGMROMPROT_READ_ROM_WRITE_IGNORE:
2350	case PGMROMPROT_READ_RAM_WRITE_IGNORE:
2351	return VINF_SUCCESS;
2352
2353	/*
2354	* Write to the ram page.
2355	*/
2356	case PGMROMPROT_READ_ROM_WRITE_RAM:
2357	case PGMROMPROT_READ_RAM_WRITE_RAM: /* yes this will get here too, it's way simpler that way. */
2358	{
2359	/* This should be impossible now, pvPhys doesn't work cross page anylonger. */
2360	Assert(((GCPhys - pRom->GCPhys + cbBuf - 1) >> PAGE_SHIFT) == iPage);
2361
2362	/*
2363	* Take the lock, do lazy allocation, map the page and copy the data.
2364	*
2365	* Note that we have to bypass the mapping TLB since it works on
2366	* guest physical addresses and entering the shadow page would
2367	* kind of screw things up...
2368	*/
2369	int rc = pgmLock(pVM);
2370	AssertRC(rc);
2371	PPGMPAGE pShadowPage = &pRomPage->Shadow;
2372	if (!PGMROMPROT_IS_ROM(pRomPage->enmProt))
2373	{
2374	pShadowPage = pgmPhysGetPage(&pVM->pgm.s, GCPhys);
2375	AssertLogRelReturn(pShadowPage, VERR_INTERNAL_ERROR);
2376	}
2377
2378	if (RT_UNLIKELY(PGM_PAGE_GET_STATE(pShadowPage) != PGM_PAGE_STATE_ALLOCATED))
2379	{
2380	rc = pgmPhysPageMakeWritable(pVM, pShadowPage, GCPhys);
2381	if (RT_FAILURE(rc))
2382	{
2383	pgmUnlock(pVM);
2384	return rc;
2385	}
2386	AssertMsg(rc == VINF_SUCCESS \|\| rc == VINF_PGM_SYNC_CR3 /* returned */, ("%Rrc\n", rc));
2387	}
2388
2389	void *pvDstPage;
2390	PPGMPAGEMAP pMapIgnored;
2391	int rc2 = pgmPhysPageMap(pVM, pShadowPage, GCPhys & X86_PTE_PG_MASK, &pMapIgnored, &pvDstPage);
2392	if (RT_SUCCESS(rc2))
2393	memcpy((uint8_t *)pvDstPage + (GCPhys & PAGE_OFFSET_MASK), pvBuf, cbBuf);
2394	else
2395	rc = rc2;
2396
2397	pgmUnlock(pVM);
2398	return rc;
2399	}
2400
2401	default:
2402	AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhys=%RGp\n",
2403	pRom->aPages[iPage].enmProt, iPage, GCPhys),
2404	VERR_INTERNAL_ERROR);
2405	}
2406	}
2407	}
2408
2409
2410	/**
2411	* Called by PGMR3Reset to reset the shadow, switch to the virgin,
2412	* and verify that the virgin part is untouched.
2413	*
2414	* This is done after the normal memory has been cleared.
2415	*
2416	* ASSUMES that the caller owns the PGM lock.
2417	*
2418	* @param pVM The VM handle.
2419	*/
2420	int pgmR3PhysRomReset(PVM pVM)
2421	{
2422	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
2423	{
2424	const uint32_t cPages = pRom->cb >> PAGE_SHIFT;
2425
2426	if (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED)
2427	{
2428	/*
2429	* Reset the physical handler.
2430	*/
2431	int rc = PGMR3PhysRomProtect(pVM, pRom->GCPhys, pRom->cb, PGMROMPROT_READ_ROM_WRITE_IGNORE);
2432	AssertRCReturn(rc, rc);
2433
2434	/*
2435	* What we do with the shadow pages depends on the memory
2436	* preallocation option. If not enabled, we'll just throw
2437	* out all the dirty pages and replace them by the zero page.
2438	*/
2439	if (!pVM->pgm.s.fRamPreAlloc)
2440	{
2441	/* Free the dirty pages. */
2442	uint32_t cPendingPages = 0;
2443	PGMMFREEPAGESREQ pReq;
2444	rc = GMMR3FreePagesPrepare(pVM, &pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
2445	AssertRCReturn(rc, rc);
2446
2447	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2448	if (PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) != PGM_PAGE_STATE_ZERO)
2449	{
2450	Assert(PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) == PGM_PAGE_STATE_ALLOCATED);
2451	rc = pgmPhysFreePage(pVM, pReq, &cPendingPages, &pRom->aPages[iPage].Shadow, pRom->GCPhys + (iPage << PAGE_SHIFT));
2452	AssertLogRelRCReturn(rc, rc);
2453	}
2454
2455	if (cPendingPages)
2456	{
2457	rc = GMMR3FreePagesPerform(pVM, pReq, cPendingPages);
2458	AssertLogRelRCReturn(rc, rc);
2459	}
2460	GMMR3FreePagesCleanup(pReq);
2461	}
2462	else
2463	{
2464	/* clear all the shadow pages. */
2465	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2466	{
2467	Assert(PGM_PAGE_GET_STATE(&pRom->aPages[iPage].Shadow) != PGM_PAGE_STATE_ZERO);
2468
2469	const RTGCPHYS GCPhys = pRom->GCPhys + (iPage << PAGE_SHIFT);
2470	rc = pgmPhysPageMakeWritable(pVM, &pRom->aPages[iPage].Shadow, GCPhys);
2471	if (RT_FAILURE(rc))
2472	break;
2473
2474	void *pvDstPage;
2475	PPGMPAGEMAP pMapIgnored;
2476	rc = pgmPhysPageMap(pVM, &pRom->aPages[iPage].Shadow, GCPhys, &pMapIgnored, &pvDstPage);
2477	if (RT_FAILURE(rc))
2478	break;
2479	ASMMemZeroPage(pvDstPage);
2480	}
2481	AssertRCReturn(rc, rc);
2482	}
2483	}
2484
2485	#ifdef VBOX_STRICT
2486	/*
2487	* Verify that the virgin page is unchanged if possible.
2488	*/
2489	if (pRom->pvOriginal)
2490	{
2491	uint8_t const pbSrcPage = (uint8_t const )pRom->pvOriginal;
2492	for (uint32_t iPage = 0; iPage < cPages; iPage++, pbSrcPage += PAGE_SIZE)
2493	{
2494	const RTGCPHYS GCPhys = pRom->GCPhys + (iPage << PAGE_SHIFT);
2495	PPGMPAGEMAP pMapIgnored;
2496	void *pvDstPage;
2497	int rc = pgmPhysPageMap(pVM, &pRom->aPages[iPage].Virgin, GCPhys, &pMapIgnored, &pvDstPage);
2498	if (RT_FAILURE(rc))
2499	break;
2500	if (memcmp(pvDstPage, pbSrcPage, PAGE_SIZE))
2501	LogRel(("pgmR3PhysRomReset: %RGp rom page changed (%s) - loaded saved state?\n",
2502	GCPhys, pRom->pszDesc));
2503	}
2504	}
2505	#endif
2506	}
2507
2508	return VINF_SUCCESS;
2509	}
2510
2511
2512	/**
2513	* Change the shadowing of a range of ROM pages.
2514	*
2515	* This is intended for implementing chipset specific memory registers
2516	* and will not be very strict about the input. It will silently ignore
2517	* any pages that are not the part of a shadowed ROM.
2518	*
2519	* @returns VBox status code.
2520	* @retval VINF_PGM_SYNC_CR3
2521	*
2522	* @param pVM Pointer to the shared VM structure.
2523	* @param GCPhys Where to start. Page aligned.
2524	* @param cb How much to change. Page aligned.
2525	* @param enmProt The new ROM protection.
2526	*/
2527	VMMR3DECL(int) PGMR3PhysRomProtect(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, PGMROMPROT enmProt)
2528	{
2529	/*
2530	* Check input
2531	*/
2532	if (!cb)
2533	return VINF_SUCCESS;
2534	AssertReturn(!(GCPhys & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2535	AssertReturn(!(cb & PAGE_OFFSET_MASK), VERR_INVALID_PARAMETER);
2536	RTGCPHYS GCPhysLast = GCPhys + (cb - 1);
2537	AssertReturn(GCPhysLast > GCPhys, VERR_INVALID_PARAMETER);
2538	AssertReturn(enmProt >= PGMROMPROT_INVALID && enmProt <= PGMROMPROT_END, VERR_INVALID_PARAMETER);
2539
2540	/*
2541	* Process the request.
2542	*/
2543	int rc = VINF_SUCCESS;
2544	bool fFlushTLB = false;
2545	for (PPGMROMRANGE pRom = pVM->pgm.s.pRomRangesR3; pRom; pRom = pRom->pNextR3)
2546	if ( GCPhys <= pRom->GCPhysLast
2547	&& GCPhysLast >= pRom->GCPhys
2548	&& (pRom->fFlags & PGMPHYS_ROM_FLAGS_SHADOWED))
2549	{
2550	/*
2551	* Iterate the relevant pages and make necessary the changes.
2552	*/
2553	bool fChanges = false;
2554	uint32_t const cPages = pRom->GCPhysLast <= GCPhysLast
2555	? pRom->cb >> PAGE_SHIFT
2556	: (GCPhysLast - pRom->GCPhys + 1) >> PAGE_SHIFT;
2557	for (uint32_t iPage = (GCPhys - pRom->GCPhys) >> PAGE_SHIFT;
2558	iPage < cPages;
2559	iPage++)
2560	{
2561	PPGMROMPAGE pRomPage = &pRom->aPages[iPage];
2562	if (PGMROMPROT_IS_ROM(pRomPage->enmProt) != PGMROMPROT_IS_ROM(enmProt))
2563	{
2564	fChanges = true;
2565
2566	/* flush references to the page. */
2567	PPGMPAGE pRamPage = pgmPhysGetPage(&pVM->pgm.s, pRom->GCPhys + (iPage << PAGE_SHIFT));
2568	int rc2 = pgmPoolTrackFlushGCPhys(pVM, pRamPage, &fFlushTLB);
2569	if (rc2 != VINF_SUCCESS && (rc == VINF_SUCCESS \|\| RT_FAILURE(rc2)))
2570	rc = rc2;
2571
2572	PPGMPAGE pOld = PGMROMPROT_IS_ROM(pRomPage->enmProt) ? &pRomPage->Virgin : &pRomPage->Shadow;
2573	PPGMPAGE pNew = PGMROMPROT_IS_ROM(pRomPage->enmProt) ? &pRomPage->Shadow : &pRomPage->Virgin;
2574
2575	pOld = pRamPage;
2576	pRamPage = pNew;
2577	/** @todo preserve the volatile flags (handlers) when these have been moved out of HCPhys! */
2578	}
2579	pRomPage->enmProt = enmProt;
2580	}
2581
2582	/*
2583	* Reset the access handler if we made changes, no need
2584	* to optimize this.
2585	*/
2586	if (fChanges)
2587	{
2588	int rc = PGMHandlerPhysicalReset(pVM, pRom->GCPhys);
2589	AssertRCReturn(rc, rc);
2590	}
2591
2592	/* Advance - cb isn't updated. */
2593	GCPhys = pRom->GCPhys + (cPages << PAGE_SHIFT);
2594	}
2595
2596	if (fFlushTLB)
2597	PGM_INVL_GUEST_TLBS();
2598	return rc;
2599	}
2600
2601
2602	/**
2603	* Sets the Address Gate 20 state.
2604	*
2605	* @param pVM VM handle.
2606	* @param fEnable True if the gate should be enabled.
2607	* False if the gate should be disabled.
2608	*/
2609	VMMDECL(void) PGMR3PhysSetA20(PVM pVM, bool fEnable)
2610	{
2611	LogFlow(("PGMR3PhysSetA20 %d (was %d)\n", fEnable, pVM->pgm.s.fA20Enabled));
2612	if (pVM->pgm.s.fA20Enabled != fEnable)
2613	{
2614	pVM->pgm.s.fA20Enabled = fEnable;
2615	pVM->pgm.s.GCPhysA20Mask = ~(RTGCPHYS)(!fEnable << 20);
2616	REMR3A20Set(pVM, fEnable);
2617	/** @todo we're not handling this correctly for VT-x / AMD-V. See #2911 */
2618	}
2619	}
2620
2621
2622	/**
2623	* Tree enumeration callback for dealing with age rollover.
2624	* It will perform a simple compression of the current age.
2625	*/
2626	static DECLCALLBACK(int) pgmR3PhysChunkAgeingRolloverCallback(PAVLU32NODECORE pNode, void *pvUser)
2627	{
2628	/* Age compression - ASSUMES iNow == 4. */
2629	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
2630	if (pChunk->iAge >= UINT32_C(0xffffff00))
2631	pChunk->iAge = 3;
2632	else if (pChunk->iAge >= UINT32_C(0xfffff000))
2633	pChunk->iAge = 2;
2634	else if (pChunk->iAge)
2635	pChunk->iAge = 1;
2636	else /* iAge = 0 */
2637	pChunk->iAge = 4;
2638
2639	/* reinsert */
2640	PVM pVM = (PVM)pvUser;
2641	RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
2642	pChunk->AgeCore.Key = pChunk->iAge;
2643	RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2644	return 0;
2645	}
2646
2647
2648	/**
2649	* Tree enumeration callback that updates the chunks that have
2650	* been used since the last
2651	*/
2652	static DECLCALLBACK(int) pgmR3PhysChunkAgeingCallback(PAVLU32NODECORE pNode, void *pvUser)
2653	{
2654	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)pNode;
2655	if (!pChunk->iAge)
2656	{
2657	PVM pVM = (PVM)pvUser;
2658	RTAvllU32Remove(&pVM->pgm.s.ChunkR3Map.pAgeTree, pChunk->AgeCore.Key);
2659	pChunk->AgeCore.Key = pChunk->iAge = pVM->pgm.s.ChunkR3Map.iNow;
2660	RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2661	}
2662
2663	return 0;
2664	}
2665
2666
2667	/**
2668	* Performs ageing of the ring-3 chunk mappings.
2669	*
2670	* @param pVM The VM handle.
2671	*/
2672	VMMR3DECL(void) PGMR3PhysChunkAgeing(PVM pVM)
2673	{
2674	pVM->pgm.s.ChunkR3Map.AgeingCountdown = RT_MIN(pVM->pgm.s.ChunkR3Map.cMax / 4, 1024);
2675	pVM->pgm.s.ChunkR3Map.iNow++;
2676	if (pVM->pgm.s.ChunkR3Map.iNow == 0)
2677	{
2678	pVM->pgm.s.ChunkR3Map.iNow = 4;
2679	RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /fFromLeft/, pgmR3PhysChunkAgeingRolloverCallback, pVM);
2680	}
2681	else
2682	RTAvlU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pTree, true /fFromLeft/, pgmR3PhysChunkAgeingCallback, pVM);
2683	}
2684
2685
2686	/**
2687	* The structure passed in the pvUser argument of pgmR3PhysChunkUnmapCandidateCallback().
2688	*/
2689	typedef struct PGMR3PHYSCHUNKUNMAPCB
2690	{
2691	PVM pVM; /*< The VM handle. /
2692	PPGMCHUNKR3MAP pChunk; /*< The chunk to unmap. /
2693	} PGMR3PHYSCHUNKUNMAPCB, *PPGMR3PHYSCHUNKUNMAPCB;
2694
2695
2696	/**
2697	* Callback used to find the mapping that's been unused for
2698	* the longest time.
2699	*/
2700	static DECLCALLBACK(int) pgmR3PhysChunkUnmapCandidateCallback(PAVLLU32NODECORE pNode, void *pvUser)
2701	{
2702	do
2703	{
2704	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)((uint8_t *)pNode - RT_OFFSETOF(PGMCHUNKR3MAP, AgeCore));
2705	if ( pChunk->iAge
2706	&& !pChunk->cRefs)
2707	{
2708	/*
2709	* Check that it's not in any of the TLBs.
2710	*/
2711	PVM pVM = ((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pVM;
2712	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
2713	if (pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk == pChunk)
2714	{
2715	pChunk = NULL;
2716	break;
2717	}
2718	if (pChunk)
2719	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.PhysTlbHC.aEntries); i++)
2720	if (pVM->pgm.s.PhysTlbHC.aEntries[i].pMap == pChunk)
2721	{
2722	pChunk = NULL;
2723	break;
2724	}
2725	if (pChunk)
2726	{
2727	((PPGMR3PHYSCHUNKUNMAPCB)pvUser)->pChunk = pChunk;
2728	return 1; /* done */
2729	}
2730	}
2731
2732	/* next with the same age - this version of the AVL API doesn't enumerate the list, so we have to do it. */
2733	pNode = pNode->pList;
2734	} while (pNode);
2735	return 0;
2736	}
2737
2738
2739	/**
2740	* Finds a good candidate for unmapping when the ring-3 mapping cache is full.
2741	*
2742	* The candidate will not be part of any TLBs, so no need to flush
2743	* anything afterwards.
2744	*
2745	* @returns Chunk id.
2746	* @param pVM The VM handle.
2747	*/
2748	static int32_t pgmR3PhysChunkFindUnmapCandidate(PVM pVM)
2749	{
2750	/*
2751	* Do tree ageing first?
2752	*/
2753	if (pVM->pgm.s.ChunkR3Map.AgeingCountdown-- == 0)
2754	PGMR3PhysChunkAgeing(pVM);
2755
2756	/*
2757	* Enumerate the age tree starting with the left most node.
2758	*/
2759	PGMR3PHYSCHUNKUNMAPCB Args;
2760	Args.pVM = pVM;
2761	Args.pChunk = NULL;
2762	if (RTAvllU32DoWithAll(&pVM->pgm.s.ChunkR3Map.pAgeTree, true /fFromLeft/, pgmR3PhysChunkUnmapCandidateCallback, pVM))
2763	return Args.pChunk->Core.Key;
2764	return INT32_MAX;
2765	}
2766
2767
2768	/**
2769	* Maps the given chunk into the ring-3 mapping cache.
2770	*
2771	* This will call ring-0.
2772	*
2773	* @returns VBox status code.
2774	* @param pVM The VM handle.
2775	* @param idChunk The chunk in question.
2776	* @param ppChunk Where to store the chunk tracking structure.
2777	*
2778	* @remarks Called from within the PGM critical section.
2779	*/
2780	int pgmR3PhysChunkMap(PVM pVM, uint32_t idChunk, PPPGMCHUNKR3MAP ppChunk)
2781	{
2782	int rc;
2783
2784	/*
2785	* Allocate a new tracking structure first.
2786	*/
2787	# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
2788	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)MMR3HeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk));
2789	# else
2790	PPGMCHUNKR3MAP pChunk = (PPGMCHUNKR3MAP)MMR3UkHeapAlloc(pVM, MM_TAG_PGM_CHUNK_MAPPING, sizeof(*pChunk), NULL);
2791	# endif
2792	AssertReturn(pChunk, VERR_NO_MEMORY);
2793	pChunk->Core.Key = idChunk;
2794	pChunk->AgeCore.Key = pVM->pgm.s.ChunkR3Map.iNow;
2795	pChunk->iAge = 0;
2796	pChunk->cRefs = 0;
2797	pChunk->cPermRefs = 0;
2798	pChunk->pv = NULL;
2799
2800	/*
2801	* Request the ring-0 part to map the chunk in question and if
2802	* necessary unmap another one to make space in the mapping cache.
2803	*/
2804	GMMMAPUNMAPCHUNKREQ Req;
2805	Req.Hdr.u32Magic = SUPVMMR0REQHDR_MAGIC;
2806	Req.Hdr.cbReq = sizeof(Req);
2807	Req.pvR3 = NULL;
2808	Req.idChunkMap = idChunk;
2809	Req.idChunkUnmap = NIL_GMM_CHUNKID;
2810	if (pVM->pgm.s.ChunkR3Map.c >= pVM->pgm.s.ChunkR3Map.cMax)
2811	Req.idChunkUnmap = pgmR3PhysChunkFindUnmapCandidate(pVM);
2812	rc = VMMR3CallR0(pVM, VMMR0_DO_GMM_MAP_UNMAP_CHUNK, 0, &Req.Hdr);
2813	if (RT_SUCCESS(rc))
2814	{
2815	/*
2816	* Update the tree.
2817	*/
2818	/* insert the new one. */
2819	AssertPtr(Req.pvR3);
2820	pChunk->pv = Req.pvR3;
2821	bool fRc = RTAvlU32Insert(&pVM->pgm.s.ChunkR3Map.pTree, &pChunk->Core);
2822	AssertRelease(fRc);
2823	pVM->pgm.s.ChunkR3Map.c++;
2824
2825	fRc = RTAvllU32Insert(&pVM->pgm.s.ChunkR3Map.pAgeTree, &pChunk->AgeCore);
2826	AssertRelease(fRc);
2827
2828	/* remove the unmapped one. */
2829	if (Req.idChunkUnmap != NIL_GMM_CHUNKID)
2830	{
2831	PPGMCHUNKR3MAP pUnmappedChunk = (PPGMCHUNKR3MAP)RTAvlU32Remove(&pVM->pgm.s.ChunkR3Map.pTree, Req.idChunkUnmap);
2832	AssertRelease(pUnmappedChunk);
2833	pUnmappedChunk->pv = NULL;
2834	pUnmappedChunk->Core.Key = UINT32_MAX;
2835	#if 0 /* for later when we've got a separate mapping method for ring-0. */
2836	MMR3HeapFree(pUnmappedChunk);
2837	#else
2838	MMHyperFree(pVM, pUnmappedChunk);
2839	#endif
2840	pVM->pgm.s.ChunkR3Map.c--;
2841	}
2842	}
2843	else
2844	{
2845	AssertRC(rc);
2846	#if 0 /* for later when we've got a separate mapping method for ring-0. */
2847	MMR3HeapFree(pChunk);
2848	#else
2849	MMHyperFree(pVM, pChunk);
2850	#endif
2851	pChunk = NULL;
2852	}
2853
2854	*ppChunk = pChunk;
2855	return rc;
2856	}
2857
2858
2859	/**
2860	* For VMMCALLHOST_PGM_MAP_CHUNK, considered internal.
2861	*
2862	* @returns see pgmR3PhysChunkMap.
2863	* @param pVM The VM handle.
2864	* @param idChunk The chunk to map.
2865	*/
2866	VMMR3DECL(int) PGMR3PhysChunkMap(PVM pVM, uint32_t idChunk)
2867	{
2868	PPGMCHUNKR3MAP pChunk;
2869	return pgmR3PhysChunkMap(pVM, idChunk, &pChunk);
2870	}
2871
2872
2873	/**
2874	* Invalidates the TLB for the ring-3 mapping cache.
2875	*
2876	* @param pVM The VM handle.
2877	*/
2878	VMMR3DECL(void) PGMR3PhysChunkInvalidateTLB(PVM pVM)
2879	{
2880	pgmLock(pVM);
2881	for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.ChunkR3Map.Tlb.aEntries); i++)
2882	{
2883	pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].idChunk = NIL_GMM_CHUNKID;
2884	pVM->pgm.s.ChunkR3Map.Tlb.aEntries[i].pChunk = NULL;
2885	}
2886	pgmUnlock(pVM);
2887	}
2888
2889
2890	/**
2891	* Response to VM_FF_PGM_NEED_HANDY_PAGES and VMMCALLHOST_PGM_ALLOCATE_HANDY_PAGES.
2892	*
2893	* This function will also work the VM_FF_PGM_NO_MEMORY force action flag, to
2894	* signal and clear the out of memory condition. When contracted, this API is
2895	* used to try clear the condition when the user wants to resume.
2896	*
2897	* @returns The following VBox status codes.
2898	* @retval VINF_SUCCESS on success. FFs cleared.
2899	* @retval VINF_EM_NO_MEMORY if we're out of memory. The FF is not cleared in
2900	* this case and it gets accompanied by VM_FF_PGM_NO_MEMORY.
2901	*
2902	* @param pVM The VM handle.
2903	*
2904	* @remarks The VINF_EM_NO_MEMORY status is for the benefit of the FF processing
2905	* in EM.cpp and shouldn't be propagated outside TRPM, HWACCM, EM and
2906	* pgmPhysEnsureHandyPage. There is one exception to this in the \#PF
2907	* handler.
2908	*/
2909	VMMR3DECL(int) PGMR3PhysAllocateHandyPages(PVM pVM)
2910	{
2911	pgmLock(pVM);
2912
2913	/*
2914	* Allocate more pages, noting down the index of the first new page.
2915	*/
2916	uint32_t iClear = pVM->pgm.s.cHandyPages;
2917	AssertMsgReturn(iClear <= RT_ELEMENTS(pVM->pgm.s.aHandyPages), ("%d", iClear), VERR_INTERNAL_ERROR);
2918	Log(("PGMR3PhysAllocateHandyPages: %d -> %d\n", iClear, RT_ELEMENTS(pVM->pgm.s.aHandyPages)));
2919	int rcAlloc = VINF_SUCCESS;
2920	int rcSeed = VINF_SUCCESS;
2921	int rc = VMMR3CallR0(pVM, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
2922	while (rc == VERR_GMM_SEED_ME)
2923	{
2924	void *pvChunk;
2925	rcAlloc = rc = SUPPageAlloc(GMM_CHUNK_SIZE >> PAGE_SHIFT, &pvChunk);
2926	if (RT_SUCCESS(rc))
2927	{
2928	rcSeed = rc = VMMR3CallR0(pVM, VMMR0_DO_GMM_SEED_CHUNK, (uintptr_t)pvChunk, NULL);
2929	if (RT_FAILURE(rc))
2930	SUPPageFree(pvChunk, GMM_CHUNK_SIZE >> PAGE_SHIFT);
2931	}
2932	if (RT_SUCCESS(rc))
2933	rc = VMMR3CallR0(pVM, VMMR0_DO_PGM_ALLOCATE_HANDY_PAGES, 0, NULL);
2934	}
2935
2936	if (RT_SUCCESS(rc))
2937	{
2938	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
2939	Assert(pVM->pgm.s.cHandyPages > 0);
2940	VM_FF_CLEAR(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
2941	VM_FF_CLEAR(pVM, VM_FF_PGM_NO_MEMORY);
2942
2943	/*
2944	* Clear the pages.
2945	*/
2946	while (iClear < pVM->pgm.s.cHandyPages)
2947	{
2948	PGMMPAGEDESC pPage = &pVM->pgm.s.aHandyPages[iClear];
2949	void *pv;
2950	rc = pgmPhysPageMapByPageID(pVM, pPage->idPage, pPage->HCPhysGCPhys, &pv);
2951	AssertLogRelMsgBreak(RT_SUCCESS(rc), ("idPage=%#x HCPhysGCPhys=%RHp rc=%Rrc", pPage->idPage, pPage->HCPhysGCPhys, rc));
2952	ASMMemZeroPage(pv);
2953	iClear++;
2954	Log3(("PGMR3PhysAllocateHandyPages: idPage=%#x HCPhys=%RGp\n", pPage->idPage, pPage->HCPhysGCPhys));
2955	}
2956	}
2957	else
2958	{
2959	/*
2960	* We should never get here unless there is a genuine shortage of
2961	* memory (or some internal error). Flag the error so the VM can be
2962	* suspended ASAP and the user informed. If we're totally out of
2963	* handy pages we will return failure.
2964	*/
2965	/* Report the failure. */
2966	LogRel(("PGM: Failed to procure handy pages; rc=%Rrc rcAlloc=%Rrc rcSeed=%Rrc cHandyPages=%#x\n"
2967	" cAllPages=%#x cPrivatePages=%#x cSharedPages=%#x cZeroPages=%#x\n",
2968	rc, rcSeed, rcAlloc,
2969	pVM->pgm.s.cHandyPages,
2970	pVM->pgm.s.cAllPages,
2971	pVM->pgm.s.cPrivatePages,
2972	pVM->pgm.s.cSharedPages,
2973	pVM->pgm.s.cZeroPages));
2974	if ( rc != VERR_NO_MEMORY
2975	&& rc != VERR_LOCK_FAILED)
2976	{
2977	for (uint32_t i = 0; i < RT_ELEMENTS(pVM->pgm.s.aHandyPages); i++)
2978	{
2979	LogRel(("PGM: aHandyPages[#%#04x] = {.HCPhysGCPhys=%RHp, .idPage=%#08x, .idSharedPage=%#08x}\n",
2980	i, pVM->pgm.s.aHandyPages[i].HCPhysGCPhys, pVM->pgm.s.aHandyPages[i].idPage,
2981	pVM->pgm.s.aHandyPages[i].idSharedPage));
2982	uint32_t const idPage = pVM->pgm.s.aHandyPages[i].idPage;
2983	if (idPage != NIL_GMM_PAGEID)
2984	{
2985	for (PPGMRAMRANGE pRam = pVM->pgm.s.pRamRangesR3;
2986	pRam;
2987	pRam = pRam->pNextR3)
2988	{
2989	uint32_t const cPages = pRam->cb >> PAGE_SHIFT;
2990	for (uint32_t iPage = 0; iPage < cPages; iPage++)
2991	if (PGM_PAGE_GET_PAGEID(&pRam->aPages[iPage]) == idPage)
2992	LogRel(("PGM: Used by %RGp %R[pgmpage] (%s)\n",
2993	pRam->GCPhys + ((RTGCPHYS)iPage << PAGE_SHIFT), &pRam->aPages[iPage], pRam->pszDesc));
2994	}
2995	}
2996	}
2997	}
2998
2999	/* Set the FFs and adjust rc. */
3000	VM_FF_SET(pVM, VM_FF_PGM_NEED_HANDY_PAGES);
3001	VM_FF_SET(pVM, VM_FF_PGM_NO_MEMORY);
3002	if ( rc == VERR_NO_MEMORY
3003	\|\| rc == VERR_LOCK_FAILED)
3004	rc = VINF_EM_NO_MEMORY;
3005	}
3006
3007	pgmUnlock(pVM);
3008	return rc;
3009	}
3010
3011
3012	/**
3013	* Frees the specified RAM page and replaces it with the ZERO page.
3014	*
3015	* This is used by ballooning, remapping MMIO2 and RAM reset.
3016	*
3017	* @param pVM Pointer to the shared VM structure.
3018	* @param pReq Pointer to the request.
3019	* @param pPage Pointer to the page structure.
3020	* @param GCPhys The guest physical address of the page, if applicable.
3021	*
3022	* @remarks The caller must own the PGM lock.
3023	*/
3024	static int pgmPhysFreePage(PVM pVM, PGMMFREEPAGESREQ pReq, uint32_t *pcPendingPages, PPGMPAGE pPage, RTGCPHYS GCPhys)
3025	{
3026	/*
3027	* Assert sanity.
3028	*/
3029	Assert(PDMCritSectIsOwner(&pVM->pgm.s.CritSect));
3030	if (RT_UNLIKELY( PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_RAM
3031	&& PGM_PAGE_GET_TYPE(pPage) != PGMPAGETYPE_ROM_SHADOW))
3032	{
3033	AssertMsgFailed(("GCPhys=%RGp pPage=%R[pgmpage]\n", GCPhys, pPage));
3034	return VMSetError(pVM, VERR_PGM_PHYS_NOT_RAM, RT_SRC_POS, "GCPhys=%RGp type=%d", GCPhys, PGM_PAGE_GET_TYPE(pPage));
3035	}
3036
3037	if (PGM_PAGE_GET_STATE(pPage) == PGM_PAGE_STATE_ZERO)
3038	return VINF_SUCCESS;
3039
3040	const uint32_t idPage = PGM_PAGE_GET_PAGEID(pPage);
3041	Log3(("pgmPhysFreePage: idPage=%#x HCPhys=%RGp pPage=%R[pgmpage]\n", idPage, pPage));
3042	if (RT_UNLIKELY( idPage == NIL_GMM_PAGEID
3043	\|\| idPage > GMM_PAGEID_LAST
3044	\|\| PGM_PAGE_GET_CHUNKID(pPage) == NIL_GMM_CHUNKID))
3045	{
3046	AssertMsgFailed(("GCPhys=%RGp pPage=%R[pgmpage]\n", GCPhys, pPage));
3047	return VMSetError(pVM, VERR_PGM_PHYS_INVALID_PAGE_ID, RT_SRC_POS, "GCPhys=%RGp idPage=%#x", GCPhys, pPage);
3048	}
3049
3050	/* update page count stats. */
3051	if (PGM_PAGE_IS_SHARED(pPage))
3052	pVM->pgm.s.cSharedPages--;
3053	else
3054	pVM->pgm.s.cPrivatePages--;
3055	pVM->pgm.s.cZeroPages++;
3056
3057	/*
3058	* pPage = ZERO page.
3059	*/
3060	PGM_PAGE_SET_HCPHYS(pPage, pVM->pgm.s.HCPhysZeroPg);
3061	PGM_PAGE_SET_STATE(pPage, PGM_PAGE_STATE_ZERO);
3062	PGM_PAGE_SET_PAGEID(pPage, NIL_GMM_PAGEID);
3063
3064	/*
3065	* Make sure it's not in the handy page array.
3066	*/
3067	for (uint32_t i = pVM->pgm.s.cHandyPages; i < RT_ELEMENTS(pVM->pgm.s.aHandyPages); i++)
3068	{
3069	if (pVM->pgm.s.aHandyPages[i].idPage == idPage)
3070	{
3071	pVM->pgm.s.aHandyPages[i].idPage = NIL_GMM_PAGEID;
3072	break;
3073	}
3074	if (pVM->pgm.s.aHandyPages[i].idSharedPage == idPage)
3075	{
3076	pVM->pgm.s.aHandyPages[i].idSharedPage = NIL_GMM_PAGEID;
3077	break;
3078	}
3079	}
3080
3081	/*
3082	* Push it onto the page array.
3083	*/
3084	uint32_t iPage = *pcPendingPages;
3085	Assert(iPage < PGMPHYS_FREE_PAGE_BATCH_SIZE);
3086	*pcPendingPages += 1;
3087
3088	pReq->aPages[iPage].idPage = idPage;
3089
3090	if (iPage + 1 < PGMPHYS_FREE_PAGE_BATCH_SIZE)
3091	return VINF_SUCCESS;
3092
3093	/*
3094	* Flush the pages.
3095	*/
3096	int rc = GMMR3FreePagesPerform(pVM, pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE);
3097	if (RT_SUCCESS(rc))
3098	{
3099	GMMR3FreePagesRePrep(pVM, pReq, PGMPHYS_FREE_PAGE_BATCH_SIZE, GMMACCOUNT_BASE);
3100	*pcPendingPages = 0;
3101	}
3102	return rc;
3103	}
3104
3105
3106	/**
3107	* Converts a GC physical address to a HC ring-3 pointer, with some
3108	* additional checks.
3109	*
3110	* @returns VBox status code.
3111	* @retval VINF_SUCCESS on success.
3112	* @retval VINF_PGM_PHYS_TLB_CATCH_WRITE and *ppv set if the page has a write
3113	* access handler of some kind.
3114	* @retval VERR_PGM_PHYS_TLB_CATCH_ALL if the page has a handler catching all
3115	* accesses or is odd in any way.
3116	* @retval VERR_PGM_PHYS_TLB_UNASSIGNED if the page doesn't exist.
3117	*
3118	* @param pVM The VM handle.
3119	* @param GCPhys The GC physical address to convert.
3120	* @param fWritable Whether write access is required.
3121	* @param ppv Where to store the pointer corresponding to GCPhys on
3122	* success.
3123	*/
3124	VMMR3DECL(int) PGMR3PhysTlbGCPhys2Ptr(PVM pVM, RTGCPHYS GCPhys, bool fWritable, void **ppv)
3125	{
3126	pgmLock(pVM);
3127
3128	PPGMRAMRANGE pRam;
3129	PPGMPAGE pPage;
3130	int rc = pgmPhysGetPageAndRangeEx(&pVM->pgm.s, GCPhys, &pPage, &pRam);
3131	if (RT_SUCCESS(rc))
3132	{
3133	if (!PGM_PAGE_HAS_ANY_HANDLERS(pPage))
3134	rc = VINF_SUCCESS;
3135	else
3136	{
3137	if (PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)) /* catches MMIO */
3138	rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
3139	else if (PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage))
3140	{
3141	/** @todo Handle TLB loads of virtual handlers so ./test.sh can be made to work
3142	* in -norawr0 mode. */
3143	if (fWritable)
3144	rc = VINF_PGM_PHYS_TLB_CATCH_WRITE;
3145	}
3146	else
3147	{
3148	/* Temporariliy disabled phycial handler(s), since the recompiler
3149	doesn't get notified when it's reset we'll have to pretend its
3150	operating normally. */
3151	if (pgmHandlerPhysicalIsAll(pVM, GCPhys))
3152	rc = VERR_PGM_PHYS_TLB_CATCH_ALL;
3153	else
3154	rc = VINF_PGM_PHYS_TLB_CATCH_WRITE;
3155	}
3156	}
3157	if (RT_SUCCESS(rc))
3158	{
3159	int rc2;
3160
3161	/* Make sure what we return is writable. */
3162	if (fWritable && rc != VINF_PGM_PHYS_TLB_CATCH_WRITE)
3163	switch (PGM_PAGE_GET_STATE(pPage))
3164	{
3165	case PGM_PAGE_STATE_ALLOCATED:
3166	break;
3167	case PGM_PAGE_STATE_ZERO:
3168	case PGM_PAGE_STATE_SHARED:
3169	case PGM_PAGE_STATE_WRITE_MONITORED:
3170	rc2 = pgmPhysPageMakeWritable(pVM, pPage, GCPhys & ~(RTGCPHYS)PAGE_OFFSET_MASK);
3171	AssertLogRelRCReturn(rc2, rc2);
3172	break;
3173	}
3174
3175	/* Get a ring-3 mapping of the address. */
3176	PPGMPAGER3MAPTLBE pTlbe;
3177	rc2 = pgmPhysPageQueryTlbe(&pVM->pgm.s, GCPhys, &pTlbe);
3178	AssertLogRelRCReturn(rc2, rc2);
3179	ppv = (void )((uintptr_t)pTlbe->pv \| (GCPhys & PAGE_OFFSET_MASK));
3180	/** @todo mapping/locking hell; this isn't horribly efficient since
3181	* pgmPhysPageLoadIntoTlb will repeate the lookup we've done here. */
3182
3183	Log6(("PGMR3PhysTlbGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage] ppv=%p\n", GCPhys, rc, pPage, ppv));
3184	}
3185	else
3186	Log6(("PGMR3PhysTlbGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage]\n", GCPhys, rc, pPage));
3187
3188	/* else: handler catching all access, no pointer returned. */
3189	}
3190	else
3191	rc = VERR_PGM_PHYS_TLB_UNASSIGNED;
3192
3193	pgmUnlock(pVM);
3194	return rc;
3195	}
3196
3197
3198

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/PGMPhys.cpp@ 18811

Download in other formats: